‘Don’t want you to know’: Chilling warning issued for modern ‘connected cars’

Cars used to represent ultimate freedom. But a new study proves that today, the opposite is true – and that instead, you can be “controlled”.

The private car used to be a symbol of freedom and liberation.

It was a personal, enclosed, lockable space. Everything about it was under your control – from gearstick to throttle, from temperature to volume setting.

But a new study from the University of New South Wales Law and Justice department proves this is no longer true.

You’re being watched.

You can be controlled.

And car manufacturers don’t want you to know it.

The ‘connected car’

Modern cars – whether petrol, diesel, electric or hybrid – are increasingly computerised. And this computing power is being magnified through a multitude of internet-enabled features.

Your car can send an automated distress call if it’s involved in an accident.

Your car can call for help if it senses a child left alone under a hot sun.

Yes, your car is listening.

It can warn you of speed limits. It notices if passengers are wearing seatbelts or not. It delivers diagnostic information to your mechanic.

But it also knows your favourite streaming services and choice of radio shows. Who you’ve been talking to. And what about.

It does this by relaying the data from all its various sensors to a centralised, proprietary-owned server.

And it’s what happens there that has privacy and legal experts concerned,

“The data they collect can create a highly revealing picture of each driver,” warns UNSW associate professor of law and justice Katherine Kemp.

“If this data is misused, it can result in privacy and security threats.”

How many cars are tied to mobile phone apps makes matters even less secure.

On the surface, the features sound appealing.

You can cool the car before you walk up to it. And it will unlock the doors as you do so.

If you forget where you parked, it can help guide you.

It will report tyre pressure, oil condition and fuel states.

You can even check out its surroundings by remotely accessing its cameras.

It’s predicted that by 2031, 93 per cent of new car sales will be of intrinsically connected vehicles.

Modern cars are increasingly computerised. Picture: Supplied

Under the bonnet

The Driving Blind: The Unexamined Privacy Risks of Connected Cars report paints a picture of an automotive industry determined to hide what it can – and does – do with your online car.

It analysed the privacy documents issued by 15 car brands available in Australia.

“There are enormous obstacles for consumers who want to find and understand the privacy terms,” Kemp reports.

“Some brands also make inaccurate claims that certain information is not ‘personal information’, implying the Privacy Act doesn’t apply to that data.

“Some companies are also repurposing personal information for ‘marketing’ or ‘research’, and sharing data with third parties.”

That includes your insurance company.

Your roadside service provider.

Your parents or partner.

“It can facilitate crimes, including domestic violence, stalking and robbery,” warns Kemp.

But the report also finds that evaluating the privacy risk posed by individual carmakers is not easy.

The detail is often buried among various disclosure documents, totalling about 14,000 words.

“Other hurdles for consumers included missing privacy terms, unhelpful interfaces, and significant errors in published privacy policies,” Kemp adds.

There are obstacles for consumers who want to find and understand the privacy terms. Picture: iStock

Loopholes and legalese

Many car manufacturers insist that the information they collect “does not, or does not its own, personally identify” users.

The devil is in the qualifier.

Most elements of the bundled data will quickly reveal the driver’s identity if they are linked to each other. The GPS track won’t, for example, say who you are. But the work or home address destination will. And the car’s data can be cross-referenced to the attached mobile phone by data-mining companies such as Meta and Google.

Your choices, habits and behaviours are valuable.

Marketing agencies want to know when to hit you with what advertising. Insurance companies want to know how risky your behaviour is.

“In some cases, they say they will use it for making predictions about the individual’s behaviour – all without requiring express consent,” adds Kemp.

Mazda says it collects any personal data transmitted via its connected cars and the phone app, including “voice” and “SMS”, destination records, fuel levels and other “driving data”.

It goes on to say it matches this data with information purchased from Facebook social media giant Meta, search engine monopoly Google and advertising hub The Trade Desk. This includes “indoor positioning information”, personal IP addresses, web browsing histories and “hashed emails”.

Ford admits that “members are identifiable when the social media partner matches our anonymised data to its anonymised data of its users”, according to its disclosure statement.

Put simply, their data is not anonymous.

“To be clear, if it is possible to identify individuals by matching Ford’s ‘anonymised data’ with Facebook’s ‘anonymised data’, both these datasets are personal information before that matching occurred, and the use of the term ‘anonymised’ seems likely to mislead consumers,” the ANU report concludes.

Mazda says it collects any personal data transmitted via its connected cars and the phone app, including “voice” and “SMS”. Picture: iStock

For your eyes only?

Mazda says it collects data for “marketing, advertising and sales … to target and personalise our web-based content to you … developing and improving our business” and “to contact you with further information about … the products and services of … our third-party marketing partners”.

But General Motors has been accused of selling identifiable vehicle tracking data to insurance companies in the United States. Owners are suing the manufacturer after being unexpectedly issued steep premium increases.

Chinese state-backed vehicle manufacturer BYD (marketed as Build Your Dreams in Australia) admits in its limited documentation that it collects “telematics log data”, “speed, battery and charging, odometer readings, vehicle mechanisms, Electronic Control Unit information”, “real-time locations” and “address details”.

It adds that this can be used for “marketing, promotional and advertising activities” and “data analytics and market research”.

BYD admits it is listening in. Picture: Christopher Furlong/Getty Images

But it also states that it will “share your information with other organisations whether or not part of our group [including] … other external parties whatsoever”.

Under Chinese Communist Party law, all Chinese-owned companies must make all their data and records available to the party.

BYD implies this by insisting users have provided implied permission for “surveillance” for “improper activities”.

It states it will share personal data gathered “through surveillance activities undertaken to assist in the protection of people, property and company assets and resources … in connection with suspected illegal or improper activities …”

A separate BYD User Agreement explains what this means. BYD Australian users must not “insult other countries or regions” or “[s]pread rumours, disrupt social order, and undermine social stability”.

Jamie Seidel is a freelance writer | @JamieSeidel