'Creepy' data collection is happening in cars with no universal safeguards for drivers

WASHINGTON (SOA) — Technology in cars can make driving more convenient, but it's also raising questions about how much data it's allowing car companies to collect on us, and even sell to third parties. You might be surprised by the enormous amounts of information they're gathering and sharing. Still, despite warnings from experts and lawmakers, there's no universal protection for drivers. Spotlight on America investigates growing criticism that it’s a violation of driver privacy.

When you're driving down the road, you might think you're alone, but your car could be watching you.

RJ Cross studies this every day, as Consumer Data Protection Director at PIRG, or the Public Interest Research Group.

"It's basically computers on wheels," said Cross. "They are filled with sensors, they're filled with cameras."

All that technology makes it possible for vehicles to collect very sensitive information about us, and potentially use it to make money.

"They know where you're parking at night, they know where you're driving to in the morning," Cross said. "They know if you're dropping your kid off at school, where that school is."

And when you connect your phone to Bluetooth technology in your vehicle to play music, or use your contacts, that opens up another whole level of access to your data: everything from text messages to emails.

Spotlight on America discovered stunning examples of data collected by car companies, revealed in those lengthy privacy policies that most drivers never read.

Not only do they collect your precise location and speed, but also very personal information like your age, health data, immigration status, even information on your sex life.

Oregon State legislators David Gomberg and Willy Chotzen want to see it stop. They're both sponsoring bills to protect driver privacy in their state.

"It just feels plain creepy," said Rep. Chotzen. "We've gotten to a point where our phones or cars often know more about us than our closest friends."

Rep. Gomberg calls cars a "privacy nightmare," citing examples of data collected by cars being transmitted to car manufacturers and shared with other third parties.

"Can you think of anything more personal than what you do in your home or your car?" Gomberg asked.

It's a growing concern.

In a lawsuit filed last August against General Motors, the Texas Attorney General alleged that GM violated the state's privacy law, accusing the company of collecting detailed driver data through its Smart Driver Program and selling it to insurance companies.

RJ Cross said all that data can be profitable for automakers.

"It's highly lucrative because it can reveal so much about who you are and how you drive and your personality that there's a big marketplace for location data," she said.

GM told Spotlight it ended the Smart Driver Program last year due to "customer feedback." But in court filings, the automaker defended its policy, arguing drivers should have no expectation of privacy when on a public road.

GM didn't want to comment on litigation, but did provide answers to several questions we posed in writing. You can read them at the bottom of this article.

And we discovered in a patent made public last year, Ford outlined how it could use an individual's personal driver data to establish the number and frequency of ads presented to "maximize ad-based monetization," even by listening to conversations inside the car.

Ford told us that submitting patent applications is part of any strong business and should not be viewed "as an indication of our business or product plans."

In another case that came under scrutiny, Jeep owners were shocked earlier this year to see repeated pop-up ads on their dash screen every time their car stopped. The ads had to be manually dismissed. Drivers were outraged and flooded social media with complaints.

A spokesperson from Stellantis, which owns Jeep, told Spotlight, "This was an isolated software glitch that as of early February, had affected fewer than 10 vehicles. Our Jeep customer care teams reached out to every affected customer. Our goal is to deliver the best vehicle experience for our customers, so we understand how frustrating it can be when that expectation is not met. On average, a customer can expect to receive one single pop-up message per year to offer information and services that help them better understand their specific vehicle."

"There is no question that this was ridiculous and dangerous," Cross said. "It can risk driver safety to have a distracting thing on your screen like that."

Oregon Rep. Willy Chotzen told us it's like opening Pandora's box.

"We know that technology is changing faster than most of us can keep up with it," he said.

Right now, there is no federal law that limits what data car companies can collect and how it's used, which is why a handful of states like Oregon are proposing their own legislation to rein in the unrestricted collection and use of car driver data.

"It's a weakness in the process right now, and we've got to plug that weakness and make sure that we're protecting the rights of Oregonians to that precious privacy that is so fleeting in our modern world," said Rep. Gomberg.

Still, they agree that a universal, federal law is needed.

We found out there have been several car data privacy bills introduced in Congress over the past six months, in both the House and the Senate. So far, they have not advanced in either chamber. We repeatedly requested interviews with the members of Congress co-sponsoring the legislation, but none would agree to sit down and talk about it.

--

Below are the questions we asked to GM regarding privacy and their responses:

Does GM continue to collect data from drivers? If so, how many drivers are impacted?

Regarding our discontinued Smart Driver program:

Last year, we discontinued Smart Driver across all GM vehicles, unenrolled all customers, and ended our third-party telematics relationships with LexisNexis and Verisk.

Regarding GM’s data practices:

Connectivity is essential for delivering OnStar and other services that our customers love; it enables navigation and communication, keeps your car running smoothly, and helps keep you safe. We know that we have a responsibility to protect customer data and communicate clearly about how it will be used, and we’re continuously working to raise the bar on privacy.

Can drivers opt out of data collection?

Yes. Connectivity offers many benefits, including navigation, entertainment, and enhanced safety features, but customers can turn it off at any time.

How can they do so?

Customers can unenroll from connectivity by canceling OnStar and disconnecting from the cellular network by contacting an OnStar advisor through blue button in their vehicle or calling 1.888.4ONSTAR.

Also, most GM vehicles now have the option to disable location services from within the settings menu. We reference this in our privacy statement:

"Some model year 2019 and later vehicles may have an option to disable location services. If you disable location services, we collect Geolocation Information only in the event of an emergency (such as in the event of a crash or when the emergency call button is pressed). Consult your vehicle Owner’s Manual for more information."