These Modern Cars Are Revealing and Selling Your Secrets

Modern cars made by the leading global brands are collecting, sharing and selling user data, receiving "failing marks" at protecting user privacy, according to a new report by the Mozilla Foundation.

Mozilla, which is perhaps best known for its open-source web browser Firefox, released research on Wednesday highlighting the ways that automakers "share deeply personal data, including sexual activity, facial expressions, and genetic and health information." The report specifically called out Ford, BMW, Tesla, Subaru, KIA, Nissan and Toyota.

This data, researchers say is collected via the technology in the car, including the car's "sensors, microphones, cameras, and the phones and devices drivers connect to their cars, as well as by car apps, company websites, dealerships, and vehicle telematics.

Nissan

The research gave Nissan the worst marks, saying that the automaker even sells data related to a driver's "intelligence" and "psychological trends," among others. "The Japanese car manufacturer admits in their privacy policy to collecting a wide range of information, including sexual activity, health diagnosis data, and genetic data—but doesn't specify how," the report said.

Nissan, however, in a statement emailed to Newsweek on Friday, said that it takes customer privacy seriously, but admits to collecting and sharing information within the scope of the law.

"Nissan takes privacy and data protection for our consumers and employees very seriously. When we do collect or share personal data, we comply with all applicable laws and provide the utmost transparency. Nissan North America's Privacy Policy incorporates a broad definition of Personal Information and Sensitive Personal Information, as expressly listed in the growing patchwork of evolving state privacy laws in the U.S., and is inclusive of types of data it may receive through incidental means," the carmaker said.

Tesla

When it comes to Tesla, the researchers called out the electronic vehicle maker, which is owned by billionaire Elon Musk, for having a vague and confusing privacy policy. "Serious data leaks and breaches are ordinary in the industry," the report warned, citing Tesla employees "gawking at videos captured by consumers' cars."

Modern cars "privacy flaws impact not just the driver, but also passengers and sometimes even nearby pedestrians," Misha Rykov, one of the researchers behind the report, said in a press release.

"They can hear you, see you, and track you. Today, sitting in someone's car is a lot like handing your phone over to the auto manufacturer," Rykov said.

BMW

One key finding for BMW mentioned in the report was the convolution in how to address privacy concerns, saying the creation of these apps isn't straightforward, creating the possibility of data sharing between automakers; "BMW USA, for example, manages an app for Toyota."

A spokesperson for BMW told Newsweek in an email that his company takes privacy seriously as well.

"For transparency, BMW NA provides our customers with comprehensive data privacy notices regarding the collection of their personal information. For individual control, BMW NA allows vehicle drivers to make granular choices regarding the collection and processing of their personal information. We voluntarily comply with a customer's data privacy requests (for example, request for access, deletion, correction) even in states where we are not required to do so. Further, we allow our customers to delete their data whether on their apps, vehicles or online," the BMW spokesperson said.

He said that BMW does not sell "customer's in-vehicle personal information."

Ford

Ford, which was listed as one of the "less creepy" automakers, was found to collect information on the driver's "age, gender, ethnicity, driver's license number, your purchase history and tendencies, who your mobile network provider is, lots of location data on your vehicle and your mobile device, voice commands and 'other utterances captured when the vehicle's voice recognition system is in 'active listen state', and more."

And, according to the report, the driver is responsible for informing the passengers of Ford's privacy policies before they accept to drive or ride in the car. Ford can collect the same information on all passengers as well as the driver.

Ford said this in response to Newsweek's inquiry on the report:

"Ford is committed to being a trusted steward of the personal information our customers choose to share with us. We utilize connected vehicle data to improve quality, minimize environmental impact, and make our vehicles safer and more enjoyable to drive and own."

A Subaru spokesperson told Newsweek in a Saturday email that the company "does not collect any data unless a vehicle owner voluntarily enrolls in telematics services."

"Even then, personal information would only be obtained from passengers during in-vehicle roadside assistance or emergency calls to aid the response. Subaru does not sell that information," the spokesperson said.

So, who was Mozilla's "least creepy" automaker? The Renault Group. The report stated Renault's existence as a "European-based car company covered by Europe's stronger privacy laws sure seems to help...Our biggest worry is that we couldn't confirm if they encrypt all the personal data stored on their cars."

Regardless of which car you drive, it may be time to look at your automaker's privacy policies.

"Increasingly, most cars are wiretaps on wheels," Albert Fox Cahn, a technology and human rights fellow at Harvard's Carr Center for Human Rights Policy, told the Associated Press. "The electronics that drivers pay more and more money to install are collecting more and more data on them and their passengers."

"There is something uniquely invasive about transforming the privacy of one's car into a corporate surveillance space," he said.

Newsweek reached out to the press offices of all the automakers mentioned in this report via email for comment.

Update, 09/09/2023 at 9:06 a.m. ET: A statement from Subaru was added.