Smart Car Dread: Mozilla Reports Tested Cars Failed Privacy Regulations, User Data at Risk

Mozilla Reveals Tested Cars Failed Privacy Regulations

Mozilla recently disclosed that all 25 car brands it tested failed its privacy standards. While all, according to Mozilla, went overboard in their data collection and use rules, some even had disclaimers about gathering more private forms of information, such as your sexual history and genetic information. As it seems, this isn't just a speculative: the tech used in today's cars can collect this type of private data, and the fine print of user agreements explains how manufacturers get you into agreement every time you switch on the ignition.

Adonne Washington, who is a policy council at the Future of Privacy Forum, said. "These privacy policies are written in a way to ensure that whatever is happening in the car if there's an inference that can be made, they're still ensuring that there's protection and that they're compliant with different state laws." The agreements take into consideration technology advancements that may occur while you own the car. According to Washington, tools designed to do one thing may soon be able to do more, therefore manufacturers must keep this in mind.

Kinds of data gathered

So it seems logical that a car manufacturer's privacy policy would include every form of data feasible in order to protect the company legally if it fell into a particular data collection area. Nissan's privacy policy, for instance, lists "sexual orientation, sexual activity, precise geolocation, health diagnosis data, and genetic information" as forms of personal data gathered.

Organizations claim prior ownership, so you can't sue if, for example, they mistakenly capture you having sex in the backseat. Nissan argued in a statement that this is why their privacy policy is still so general. Nissan claims it "does not knowingly collect or disclose customer information on sexual activity or sexual orientation," but it has those terms in its policy as "some U.S. state laws require us to account for inadvertent data we have or could infer but do not request or use." 

Why the companies need data? What is the urgency?

Aside from covering all legal bases, there's no way of knowing why these companies would want extremely sensitive information on their drivers, or what they'd do with it. Even if it isn't a "smart" car, any vehicle equipped with Bluetooth, USB, or recording capabilities may gather a lot of information on the driver.

The lack of available connected cars, paired with an absence of full disclosure related to driver data use, leaves customers with little choice but to trust that what they share is being used ethically, or that at least some of the categories of data listed in these troubling privacy policies — such as Nissan's decision to include "genetic information" — are solely linked to possible liability. The choices are basically to read each of these policies and choose the least severe, to buy a very old, probably fuel-inefficient automobile with no smart technologies, or to just not own a car at all. To that end, just around 8% of American households own a car, not because they belong to an area that is walkable with good public transportation, but because they are unable to afford one.

What choice

Customers are actively constrained by the current state of legal contract understanding, while companies are driven to limit risk by continuing to exaggerate these (often misread) agreements with more intrusive kinds of information. A lot of experts would tell you that federal regulation is the only actual option here. There have been occasional instances of state privacy laws being used to benefit customers, such as in Massachusetts and California, but for the most part, drivers have no idea they should be upset. But even if they are outraged, there is nothing much they can do except buy a car anyway.