Cars are collecting more data than ever, fueling a new type of data broker. Though car safety is tightly regulated, car data is not. And privacy advocates are concerned that connected cars could catch lawmakers off-guard—just as the unregulated collection of massive amounts of data by smartphones did. Cars are capable of amassing data on nearly every aspect of a drive, from road conditions to whether or not you’ve gained weight since the last time you sat in the driver’s seat. If you connect your phone to the car’s Bluetooth system, it’s also capable of knowing your contacts . And while most of the data that cars collect is about the vehicle itself, like the engine temperature or the tire pressure, there’s a growing market for more personal driver data, such as the driver’s name and location, driven by industries like insurance, marketing and car repairs. “There is significant potential on applications using anonymous data, but there is far more market potential with applications on personal data,” said Frederic Bruneteau, the managing director of the Ptolemus Consulting Group, a strategy firm advising on connected mobility. “The need to have consent management that is efficient is crucial.” Car location data is among the most valuable that automakers can gather, and data brokers who obtain this information have claimed that it’s far more accurate and voluminous than phone data, according to marketing material . It’s also harder for consumers to opt out of sharing their location data from a car, say privacy advocates. While you can reject permissions for a mobile app that wants to know your location, doing the same for a car could mean not having mapping services or emergency roadside assistance. While only about half of all new cars sold today have internet connections, McKinsey estimates that by 2030 , about 95 percent of new cars will be connected. This influx of data collection has spawned a new industry of data brokers, called Vehicle Data Hubs , which specialize in collecting and selling car data to customers like insurance companies, city planners and advertisers. Carmakers are considering using the technology to run ads on dashboards when they drive by certain billboards , and vehicle data brokers are already offering using car data to adjust insurance rates . Privacy advocates worry that if all of these systems are entrenched before regulations rein them in, lawmakers will have a much more difficult time protecting people’s information. So lawmakers are racing to set the rules for car data. There are privacy laws in the U.S. on car data, like the Driver Privacy Act , which passed in 2015. The law makes it so that any data collected on a car’s Event Data Recorder, a sort of black box meant to help diagnose malfunctions and crashes, belongs to the car owner, and requires consent or a warrant for this data to be used by third parties. But with connected cars, the EDR accounts for only a small amount of the data collected. No federal laws protecting driver privacy have passed since 2015, giving carmakers a window to collect and sell location data on drivers once they’ve opted into services like GPS and roadside assistance. “We think it’s way past due time to update the Driver Privacy Act,” said Andrea Amico, the founder of Privacy4Cars, a privacy tech company specializing in cars. Amico warns that infotainment systems collect at least as much data as the EDR does, and it can be extracted without a warrant. Industry groups are also trying to weaken privacy regulations. In June 2020, the Alliance for Automotive Innovation made recommendations for privacy regulations to the Uniform Law Commission. In the letter, the industry group recommended changing the definition of “personal data” to exclude “pseudonymized data,” which has had names stripped from it. Though data brokers use lots of such data, it is often relatively easy to “de-anonymize” it and figure out which pseudonym corresponds to which real person. Though Congress hasn’t passed new legislation particular to cars, lawmakers are pushing for a broader data privacy bill that covers a wide range of data, no matter what type of device collects it. The bill passed out of committee on July 20 but isn’t likely to become law without support from Senate Commerce committee chair Maria Cantwell (D-Wash.). It specifically requires automakers to get “affirmative express consent” to collect data for particular purposes. Without that type of regulation, carmakers are free to ask for access to data for life-saving purposes like emergency roadside assistance while also using that same data for profit. “The problem is once you agree to that, what consumers don’t realize is that you are also agreeing for the same data, your second-by-second geolocation data, your medical profile, anything connected to the car, is available for essentially any other purpose,” Amico said. That strategy comes from the same playbook that mobile apps have used for years: When a user gives data permissions so an app will function, it can open the door for an entire data broker ecosystem to trade your information back and forth. It’s how data from Muslim prayer apps , which need location data to point people in the direction of Mecca, ended up in the hands of the U.S. military. As Amico puts it, “Many of us have a romantic idea that cars are a place of anonymity and freedom. It’s time for Congress to realize it’s not the case anymore.”
| 
