Stop your car from spying on you

> Those sensors collect information about activity in the vehicle and surrounding environment. Nissan's data policy even claims the right to track "your sexual activity, health diagnosis data, and genetic information," though it's unclear how much they're doing now, and what they're giving themselves leeway to monitor in a more dystopian future.

Wow. I wonder what technical means are available to disable collection. You can disable the over-the-air capabilities but if the dealers can download over diagnostic ports when you bring in for servicing, it's worse.

Any guides on how to prevent each car brand/model from spying on you?

I recently bought a 2024 Toyota RAV4. Throughout the purchasing process, I kept an eagle eye out for any data collection that I might accidentally opt into. This way I avoided a free trial of Toyota Safety Connect, which tracks the location of your vehicle at all times (with the justification that it can thus be located if stolen).

Incidentally, I took a peek at my sales rep’s computer screen and saw that Toyota kept a log of every interaction with me, whether initiated by me or the sales rep, including recordings and transcriptions of every phone call. This isn’t really surprising but it was certainly interesting to see. (The rep also surreptitiously looked through my own paperwork folder when I was distracted, and later made some innocuous remarks based on financial information I kept there.)

After I drove the vehicle home, I noticed this sticker on the console: https://www.toyotanation.com/attachments/venza-cellularwarni...

Per the instructions, I pressed the SOS button to turn off the data transmission. The voice on the other end agreed to do so, but the necessary first step was to install the Toyota app. This, apparently, is how Toyota verifies that I own the vehicle and have permission to disable data collection.

I didn’t have or want the app, so I asked if there was some other way to prove that I owned the vehicle. Could the dealership do this? The agent said yes. So I went back to the dealership, and asked the receptionist whom I could talk to to disable data collection without using the app. After expressing visible surprise and confusion and asking other people for help, she concluded that she had no idea who could do that, and gave me a Toyota phone number to call.

I called this line, and after explaining, was redirected to the multimedia unit team. The rep seemed helpful, and after thirty minutes of him researching, he said he might have some instructions I could follow, and only needed to confirm that he was authorized to give them to me. After a five minute wait, he backtracked, and said I had no other option except to install the app.

Defeated, I installed the app. My phone number was a mandatory field; I tried using a fake one, but linking the app to my car required entering the same phone number on the car’s entertainment system, which would text me a code that authenticated me to the car, so I had to use a real number. I believe the app also checked my physical location against the physical location transmitted to the car before finally granting access.

Finally, I opted out of data collection through the app. I was met with a notice: if I ever removed my VIN number from my Toyota app, the vehicle would automatically begin transmitting data again. So obviously the car is still constantly connected to Toyota!

The article suggests pulling the fuse of the Data Communication Module (which contains the cell modem used for transmission). This is a good idea, but there are some extra complications. First, as the article mentions, the microphone is routed through the DCM and pulling the fuse kills it—but the passenger‐side speakers are also routed through the DCM, and lose sound if the fuse is pulled. Second, the DCM has its own internal battery, and will continue to transmit data until the battery dies, even with the fuse pulled.

So my recommendation is not to pull the fuse, but to disconnect the DCM completely, and jump the audio wires to restore your passenger‐side speakers.

Soon enough, I expect the DCM will be integrated rather than an independent module. Who knows how we’ll disable data transmission then.

Now we need an updated list of which cars still run when pulling the data collection model (DCM) fuse. Or if we are courageous we just pull the fuse when doing a test drive

Yet another thing that GDPR sort of covers for those of us living in the EU. Car manufacturers would have to at least ask for informed consent. Me pressing ok on 50 pages of terms of services is not informed consent.