Your car may know more about you than you realize.
A series of federal lawsuits involving Honda, Toyota, Volkswagen, General Motors, and Ford alleged that vehicle infotainment systems downloaded and permanently stored private text messages and call logs from phones connected to the car.
For some users, GM collected precise location information as often as every three seconds.
The cases were dismissed. But not because a court established that the technology couldn't do what the plaintiffs claimed.
Disappearing data
In the GM case, for example, the district court said the plaintiffs had not alleged sufficient injury under Washington's privacy law. It also noted that they had not alleged GM itself reviewed, used, or even had the ability to retrieve the data stored in the vehicle.
So the case did not establish that GM was secretly reading drivers’ texts. But neither did the dismissal answer the underlying technological question. The plaintiffs alleged that the infotainment system itself automatically downloaded and stored text messages and call logs from connected phones, and the court did not rule that this collection wasn’t happening.
That uncertainty is part of what makes modern connected cars so difficult for consumers to understand. Your phone talks to your car. Your car talks to manufacturer servers. Companion apps talk to still more companies.
Figuring out exactly what information is moving — and where it ends up — can be surprisingly difficult.
A new study from researchers at Northeastern University and Consumer Reports gives us a better idea.
Researchers tested 21 late-model vehicles and 30 companion smartphone apps. Nineteen of the 21 vehicles contacted at least one outside third party over Wi-Fi. The recipients included some of the biggest technology companies in the world.
The phone apps created even more connections.
Seven of the 30 apps transmitted sensitive identifiers such as VINs, email addresses, phone numbers, or precise location to companies associated with advertising and analytics. Researchers also found that pairing a manufacturer's app with the vehicle could substantially increase the number of outside companies receiving data.
And then we get to insurance.
Driver's dossier
General Motors provides one of the clearest documented examples of what can happen once driving data leaves the car.
GM offered a feature called OnStar Smart Driver that let customers monitor their driving habits.
According to the Federal Trade Commission, GM and OnStar were also collecting precise location and driving-behavior information from millions of vehicles and selling that information to third parties, including consumer-reporting agencies.
The data could get remarkably specific.
The FTC said it included hard braking, speeding, and late-night driving. For some users, GM collected precise location information as often as every three seconds.
Consumer-reporting agencies including LexisNexis and Verisk then used GM driving data to compile reports on individual drivers. The FTC says insurance companies used those reports to set rates and, in some cases, deny coverage.
We aren't talking about targeted ads or some mysterious data broker knowing which coffee shop you visit. We're talking about directly influencing what you pay for car insurance.
One consumer complained to GM that when he signed up, he understood that OnStar would track him. He had not understood that the information could be passed along to a third party and affect his insurance bill.
GM has since shut down Smart Driver and ended its telematics relationships with LexisNexis and Verisk. The company said it discontinued the program following customer feedback.
The FTC didn't stop there. In January, it finalized an order requiring GM to obtain affirmative consent before collecting or sharing certain connected-vehicle data and barring the company for five years from sharing covered geolocation and driver-behavior information with consumer-reporting agencies.
RELATED: 6 modern car technologies that make driving worse
Bill Pugliano/Getty Images
Behind the screens
That's harder to answer than you might expect.
The Northeastern researchers built a Faraday enclosure at Consumer Reports' Connecticut test facility to block cellular signals and isolate the Wi-Fi traffic coming from the vehicles. They then watched where the cars and their companion apps tried to connect.
While they could identify many of the companies receiving traffic, they couldn't always see what was inside it; much of the communication was encrypted.
That is not evidence that every transmission contained sensitive personal information. It does mean even researchers specifically studying the problem sometimes can't tell exactly what information is moving between a modern car and the companies it contacts.
For the owner, there is even less visibility.
You buy the car. You download the app. You agree to the terms. Maybe you activate remote start, navigation, emergency assistance, or one of the dozens of other connected features now built into new vehicles.
Most people aren't thinking about the advertising and analytics companies behind the screen.
Why would they be?
Connected works both ways
None of this means connected-car technology is inherently bad.
Emergency assistance needs to know where your vehicle is. Navigation requires location. An app that lets you start the car remotely obviously has to communicate with it.
But there is a big difference between collecting information necessary to provide a feature and allowing that information to begin circulating through an ecosystem the owner barely knows exists.
And consumers shouldn't have to become privacy lawyers to discover the difference.
Before activating connected services, I would want to know some fairly basic things.
What is the car collecting?
Who gets it?
Can they sell or share it?
Can I turn the collection off?
And could any of this wind up in a consumer report used to make decisions about me?
For years, the connected car was sold as safer, smarter, and more convenient, and maybe it is. Just remember: The connection works both ways.