Your Car Is Keeping Tabs On You: Who Is It Talking To and What Is It Reporting?

Personal data protections that consumers may believe they enjoy at home or work are not necessarily relevant in a vehicle. Who owns the data has not yet been legally determined with any degree of certainty.

What is clear is that anything is fair game and the only issue is who gets to collect and sell it. JL

John Quain reports in the New York Times:

No single law in the United States covers all the data captured by all the other devices in automobiles.Those include radar sensors, diagnostic systems, in-dash navigation systems, built-in cellular connections, a driver’s eye movements, the weight of people in the front seats and whether the driver’s hands are on the wheel. Smartphones connected to the car, and those not connected to the car, can also track your activities. There are few rules or laws in the United States that govern what data can be collected and used.

Cars have become rolling listening posts. They can track phone calls and texts, log queries to websites, record what radio stations you listen to — even tell you when you are breaking the law by exceeding the speed limit.

Automakers, local governments, retailers, insurers and tech companies are eager to leverage this information, especially as cars transform from computers on wheels into something more like self-driving shuttles. And they want to tap into even more data, including what your car’s video cameras see as you travel down a street.

Who gets what information and for what purposes? Here is a primer.

What Can Be Collected?

Government rules limit how event data recorders — the black boxes in cars that record information such as speed and seatbelt position in the seconds before, during and after a crash — can be used. But no single law in the United States covers all the data captured by all the other devices in automobiles.

Those devices include radar sensors, diagnostic systems, in-dash navigation systems and built-in cellular connections. Newer cars may record a driver’s eye movements, the weight of people in the front seats and whether the driver’s hands are on the wheel. Smartphones connected to the car, and those not connected to the car, can also track your activities, including any texting while driving.

There are few rules or laws in the United States that govern what data can be collected and used by companies. (An exception is medical information.) The United States generally does not ensure that companies strip out names or other personal details, or stipulate how such information should be used, for example.Typically, a driver agrees to be tracked and monitored by checking off a box on one of the user agreement forms needed to register a car’s in-dash system or a navigation app. In most cases, the driver must agree to such terms to use an app or service.

Who Owns the Data?

While anyone from an app developer to Google or Spotify may be capturing your digital moves while you drive, in most cases the primary collector and owner of this deluge of data is the automaker. And while it presents some potentially valuable new opportunities for them, it also has raised some nettlesome customer relationship problems.

General Motors learned this the hard way in 2011 when it amended the terms and conditions for its OnStar communications system. They included a change that allowed OnStar to share vehicle information with other companies and organizations without asking for additional explicit consent from customers. The change led to numerous complaints, and the incident was even cited in a 2012 Supreme Court decision about warrantless tracking as evidence that drivers expect privacy behind the wheel.

Consequently, many car companies view the acknowledgment of such data collection as problematic for customer relations. While drivers may welcome use of the information to relay diagnostic and service information (“Time for an oil change!”), automakers are aware that many consumers are wary of other uses — so much so that several companies declined to comment on their future plans or data collection policies.

Is There an Advantage to Sharing It?

There are cases in which drivers regularly choose to trade their data to get a benefit.

For example, live traffic services like Inrix and Waze can save a driver hours of agony sitting in sweltering traffic in exchange for sharing location and speed information. There are also products like Autobrain, Automatic, Zubie and Verizon Hum that offer connected car services, like car diagnostics, via a dongle that plugs into a car.

Even insurance companies are experimenting with apps and dongles that record braking, acceleration and speed with the lure of lower rates for well-mannered drivers.

In Arizona, Farmers Insurance is offering customers a 3 percent discount just for using a smartphone app that tracks driving behavior, including whether the driver is holding a phone or using a hands-free Bluetooth connection.

“We give value back to the customer,” said Mariel Devesa, Farmers’ head of product innovation, noting that drivers can save up to 13 percent on their insurance based on their habits. “And they can improve as drivers by seeing their scores.”

The benefits to consumers — and potential threats to personal privacy and security — become murkier, though, as companies trade and combine information collected from multiple sources, including cars, to reveal travel and buying patterns. Aggregated information can be purchased from navigation companies, for example, and combined with other so-called anonymized information from dating apps to identify the habits of a specific demographic.

“We can tell who’s on the road, where they live, how frequently they make this trip, and whether or not they are on vacation,” said Laura Schewel, founder of StreetLight Data, which provides such information to clients like urban planners and retailers.

What Happens Outside the U.S.?

Many countries have specific laws about what information can be collected about drivers. But some of them vary so widely that a start-up, Otonomo, has built a business on sorting through privacy and data laws around the world for automakers, helping companies remain in compliance in a changing landscape of laws and regulations.

“In France, they don’t want you to time-stamp locations,” said Ben Volkow, chief executive of Otonomo, “while in Germany they are more sensitive about speed information.”

Such cultural and legal differences make it hard for car companies to collect a consistent set of data points without legal trouble. It also makes it difficult to offer special services to customers or sell the aggregated data to marketers and retailers.

It’s not a small problem. Mercedes-Benz’s parent, Daimler, has a special data protection department, said Silke Mockert, a company spokeswoman. She said the company was already working on complying with a new version of European Union data protection rules expected to be enacted next year, as well as regularly working with the local authorities around the world.

In the United States, President Trump signed legislation in April overturning some internet privacy protections, allowing companies to more freely collect information on customers, including mobile users.

“So if you have a smartphone, and you still have an expectation of privacy,” said Ms. Schewel of StreetLight, “you’re fooling yourself.”