"If You’ve Got a New Car, It’s a Data Privacy Nightmare", 7 September 2023

...If your vehicle was made in the last few years, you’re probably driving around in a data-harvesting machine that may collect personal information as sensitive as your race, weight, and sexual activity. Volkswagen’s cars reportedly know if you’re fastening your seatbelt and how hard you hit the brakes.

That’s according to new findings from Mozilla’s *Privacy Not Included project. The nonprofit found that every major car brand fails to adhere to the most basic privacy and security standards in new internet-connected models, and all 25 of the brands Mozilla examined flunked the organization’s test. Mozilla found brands including BMW, Ford, Toyota, Tesla, and Subaru collect data about drivers including race, facial expressions, weight, health information, and where you drive. Some of the cars tested collected data you wouldn’t expect your car to know about, including details about sexual activity, race, and immigration status, according to Mozilla...

Modern cars use a variety of data harvesting tools including microphones, cameras, and the phones drivers connect to their cars. Manufacturers also collect data through their apps and websites, and can then sell or share that data with third parties.

The worst offender was Nissan, Mozilla said. The carmaker’s privacy policy suggests the manufacturer collects information including sexual activity, health diagnosis data, and genetic data, though there’s no details about how exactly that data is gathered. Nissan reserves the right to share and sell “preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes” to data brokers, law enforcement, and other third parties.

...“When we do collect or share personal data, we comply with all applicable laws and provide the utmost transparency,” said Lloryn Love-Carter, a Nissan spokesperson. “Nissan’s Privacy Policy incorporates a broad definition of Personal Information and Sensitive Personal Information, as expressly listed in the growing patchwork of evolving state privacy laws, and is inclusive of types of data it may receive through incidental means.”..

...“BMW NA provides our customers with comprehensive data privacy notices regarding the collection of their personal information. For individual control, BMW NA allows vehicle drivers to make granular choices regarding the collection and processing of their personal information,” said Phil DiIanni, a BMW spokesperson. DiIanni said BMW hasn’t reviewed the study, but said “BMW NA does not sell our customer’s in-vehicle personal information,” and the company takes “comprehensive measures to protect our customers’ data.”

Mercedes-Benz spokesperson Andrea Berg declined to comment, as the company hasn’t reviewed the study, but Berg said the MercedesMe Connect app gives users privacy settings and the ability to opt-out of certain services. Gizmodo contacted the other manufacturers named in this story, but none immediately provided comments...