We're the Researchers who looked into the privacy of 25 of the top car brands

You should care, but spend some time to appreciate the issue before rushing to judgement. There is too much armchair laweying going on in this area. I just watched louis rossmann's vid about cars collecting sexual histories. Too many people don't know what these user agreements are in the real world. BMW doesn't want to monetize your sexual history. They probably couldn't do that even with user consent. This sort of language is about protecting the car company from the user when the user is suing the car company.

Example: Car company collects location data for legitimate uses such as safety, product development or legal requirements. Then a leak happens. Some blogger looks at the data and notices that the local mayor's car parks at a gay bar ever Friday night, often remaining there until saturday afternoon. The implications are clear. Mayor then sues car company for collecting his "sexual history". The car company can then point to the user agreement. They are covered for not just the location data, but all the things that can be inferred from that location data. These seemingly outrageous agreements are more lawyers covering their asses than companies actually attempting to collect.

A better answer may be to adjust laws not to ban or unban such tracking, but simply to mandate off switches. A mechanical switch that disables the GPS antenna would cost maybe 10$ per car, comparable to any number of rarely-used mandatory features in cars these days.

> from a practical perspective it is kinda true

Folks don't realize all the things they are hiding — and can be extraordinarily important to hide — even when they're actively hiding them! My personal favorite anecdote here is comes from a debate with a friend who was staunchly asserting that she had nothing to hide. I just blindly suggested — hypothetically — that one example would be if she were in early stages of pregnancy. Seven months later, guess what she was hiding during the argument.

We have already seen the privacy implications of this at the private and government level at the same time. There is data that the government isn't allowed to collect, but it is allowed to purchases that data from 3rd parties. If the government having access to your data isn't a concern, what should be is that if the government can purchase it, anyone can.

Yes, people generally don't care if others know they shop at Target and the mundane details of their kid's softball practice, but they don't know what else is available: - When nobody is home and their house is empty. Not only can they do this in real-time especially if they can track car data, but they use see time data to determine when you're least likely to be home in the future. - Your medical history. You car was parked outside of a cardiologist and a pharmacy. You probably have high blood pressure. Did you go to an obstetrician's office for the 3rd time? Maybe you're pregnant. - How about existing and future interstate crimes? You go to a shooting range every week and since the recent passage of a law banning ammunition purchases without a background check in your state, you've started making regular runs to a neighboring state. Is this probable cause to show you're breaking the law? What about a woman going to the doctor in a state that bans abortions who makes similar trips out of state? Have you been posting about your recent bourbon tastings and making trips to the nearby state known for having better alcohol availability? - People don't care about strangers having access to boring personal details, but what about people you know? There's nothing stopping your mother-in-law from snooping on your life and asking personal questions they have no business looking at. Maybe this is cumbersome and expensive today, but considering how tech makes things easier and cheaper over time, will it always be this way? Once data is out there, it's out there forever.

Maybe people aren't concerned because these laws aren't being enforced, but how much of that is a chicken and the egg? Are they not enforced because they don't want to enforce them or because or because it's difficult to ID the people breaking the law. Data like this makes it easier.

> if you have nothing to hide

Anytime someone says that, I ask them to unlock their phone and give it to me.

Except for one person who actually did it, they quickly seem to change their position.

End of the day, ICE cars are getting more reliable due to emissions controls, and EVs are much more reliable. So the ongoing revenue stream for car companies (service) is a dead business.

The "why should we care" is the same as many other things -- the car company is going to use technology and tracking to monetize valuable features and experiences. There's few if any scenarios where this is good for you.

>"Why should we care?" That isn't a popular question in communities like HN, but it is how the average person thinks.

This is an oft repeated sentiment that really needs to be questioned. And I don't mean by posting some survey where the questioning is as nebulous as the privacy policies and EULAs that the average person is manipulated into accepting without a clear understanding of the implications.

My one piece of counter data today is that I was at the gym and saw a TV commercial for DuckDuckGo that was painting Google for the privacy thieves that they are.

Daytime TV is a demographic of boomer average users. DDG is actually paying for airtime to target them with a value prop of "we don't invade your privacy like this big thug over here does."

Maybe there is a sea change coming and we might soon see what average people think about how much value they put on their privacy.

The answer that's always missing is what hardware can be disabled to prevent the data from being harvested/transmitted/available in the first place?

Aren't there a ton of data science people here on HN? I feel like that would cause a ton of bias and skew away from the general population.

You blinked and missed it. This has been a systematic trend since software licenses started infecting vehicles.

I've been writing about this for a decade now: https://www.wired.com/2014/01/174071/

Followup from law Professor Aaron Perzanoswky: https://www.wired.com/story/plaintext-turns-out-you-own-noth...

He even wrote a book on it! https://mitpress.mit.edu/9780262535243/the-end-of-ownership/

The way that multiple (I counted 4) articles of theirs talked about it as though it was a report I was expecting a deeper analysis but they just presented keywords pulled from privacy policies and extrapolated.

The tone used was also oddly casual and blog-like for an important topic ('ugh', 'yikes', 'wtf', liberal use of exclamations—even double exclamations), apart from hypothetical scenarios which don't help ground their points. In the AMA they admit they're unaware what various aspects mean yet the articles present findings emphatically.

Mozilla recently published[1] a page about how they had four lawyers and three 'privacy experts' analyze a Microsoft service agreement and yet the page contains zero comments or analysis from them, merely containing two paragraphs that the conclusion was indecisive.

I do appreciate Mozilla bringing attention to such topics, though for all the money and effort they put in getting people to analyze things I kinda hoped their articles would be more substantive than what a reader can similarly determine.

[1] https://foundation.mozilla.org/en/campaigns/microsoft-ai/

From that link: > Level 3 and above Connected Vehicles constitute almost the totality of new vehicles produced today.

> My biggest question is which makes/models can have the surveillance anti-features disabled by unplugging a specific module or two, while losing as little legitimate functionality as possible.

Onstar usually lives in a box that can be physically disconnected. That'll keep them from spying on you/your car even if you've never activated or used their service. I never enable bluetooth on my phone, but my car still has an AUX port and I'll plug my phone into that. If I charge my phone by plugging it into the car's USB ports I use a data blocker.

Was looking into this a few motnsh ago, but a conversion kit for an ICE car was around 10–20k + labor (or tools if you’re DIYing it)… that’s pretty steep.

>Anyway, at the end of the day, no one cares about privacy.

Everyone cares about their privacy especially those who claim not to. What they really mean is they don't care for the privacy of others.

Privacy is simply the right to be left alone. To do your own business without intrusion from family, friends, the public or government or anything.

You can build your own car in the UK. If you build from a kit then the kit will typically have type approval and you just pay for your build to be inspected. If you create something unique it needs a more expensive inspection that incorporates type approval. Open source would be like a kit where you make the parts. I think legally this would be treated as a custom build. The full inspection is £450, which seems quite reasonable.

In the US, in every state that I'm familiar with, you can register/title/legally drive nearly any vehicle. There are some basic "road worthiness" conditions that have to be met, but they're usually simple and straight-forward, like "vehicle must have a rear view mirror". [1][2][3]

[1] https://dmv.utah.gov/vehicles/rebuilt/specially-constructed

[2] https://tax.utah.gov/forms-pubs/pub-09

[3] https://highwaypatrol.utah.gov/wp-content/uploads/sites/21/2...

The problem you run into is warranty - if you take it in for any kind of service, they will still have access to all data logged locally on flash.

Mozilla's brand is not a browser, it's privacy and digital freedom.

this is the kind of scope creep I love to see!