It’s very hard to opt out of the data nightmare that comes off the lot

There are lots of reasons to want to shut off your car’s data collection. The Mozilla Foundation has called modern cars “surveillance machines on wheels” and ranked them worse than any other product category last year, with all 25 car brands they reviewed failing to offer adequate privacy protections.

With sensors, microphones, and cameras, cars collect way more data than needed to operate the vehicle. They also share and sell that information to third parties, something many Americans don’t realize they’re opting into when they buy these cars. Companies are quick to flaunt their privacy policies, but those amount to pages upon pages of legalese that leave even professionals stumped about what exactly car companies collect and where that information might go.

So what can they collect?

“Pretty much everything,” said Misha Rykov, a research associate at the Mozilla Foundation, who worked on the car-privacy report. “Sex-life data, biometric data, demographic, race, sexual orientation, gender — everything.”

It doesn’t mean they necessarily do, but they’re leaving the car door open.

“The impression that we got — and this impression is supported by the official documents of the brands — is that they are trying to be a bit more like Big Tech,” Rykov said. “It looks like most of them are not entirely sure what's going on there.”

The data they may or may not collect can cause real trouble. It can notify your insurance company that you braked too hard or sped up too fast. Car companies can share your info with law enforcement without your knowledge. A domestic abuser could use it to track your whereabouts. It doesn’t take a lot of imagination to see this heading south. 

I wanted to turn off data collection on my car because it’s creepy and I thought the option would be simple. It turns out that shutting off data collection and figuring out what’s been collected is much more difficult than it would seem. I know because it took me — a reasonably informed and technologically savvy person — a month to finally do so.

I’m in good company.

“It’s comically difficult,” Thorin Klosowski, a security and privacy activist at Electronic Frontier Foundation, who’s written about how to do just this, told me. “I do this for a living and I am not 100% positive I have gotten everything correct, which is ridiculous.”

In March, my husband and I bought a new Honda. When I turned on the car to leave the dealership, I got a notification telling me that data sharing was on. Right next to “on” was an “off” button. Simple enough! But when I hit “off” I got a message telling me it was “unable to change settings while network is invalid.” Right.

My children were screaming at me from the back seat, so I assumed this was a problem I could easily fix another time. 

Time got away from me and I tried again a few days later at home. I thought maybe the initial trouble was that the cell service wasn’t good enough, so I tried to shut off the data collection when I had a better signal. Nope.

I tried looking it up online and didn’t find anything conclusive. What I did find was a recent New York Times piece by Kashmir Hill that said car companies were sharing driving data with third parties, which in turn were selling it to insurance companies to jack up people’s rates.

I called the dealer. He talked to some people at Honda and called me back. If I wanted to shut off the data sharing, I’d have to download Honda’s HondaLink app, which came with its own 14 pages of unreadable terms and conditions.

That was my only choice, he said. He also said I was the first person to ask him how to do so. I reluctantly downloaded the app, but couldn’t figure out how to shut it off from there. Finally, a day after downloading the app, I was able to shut off the data sharing in my car (confusingly, I had to do so in the car and not on the app, but only once I downloaded the app). It only took me a month.

Now, though, I will forever have a bright orange notification on my car screen telling me my data sharing is off. It’s clearly a dark pattern meant to nudge me into turning data collection back on.

Honda confirmed the notification won’t go away as long as I have data sharing off. Great! 

It’s important to add you can’t select what is collected and what isn’t; it’s all or nothing. If I want a genuinely useful-sounding safety feature — the ability to get an ambulance in the event of a collision, for example — I have to give my car information for everything else.

Following this fiasco of turning off the data, I wanted to find out what Honda had collected from our car during the time it was running. 

EFF’s handy guide sent me to Honda’s online privacy request page, where I learned we didn’t live in one of the five states where we could exercise our consumer rights to view or delete the data our car tracked. 

I tried by phone instead, to see if Honda might excuse our crime of living in New York. There I waited an hour to have someone — maybe — understand what I was asking: to see what data my car had collected on me.

I was put on several holds. At one point I was told, “We haven’t done this. We don’t know how to do this.”

Eventually they figured it out.

Two days later, we got an email: “Because you are not a current resident of a qualifying state, your request will not be processed.” I filed an appeal, this time saying I was a journalist. Two days later that was denied as well.

“American Honda strives to build and maintain a relationship of trust with our customers,” a Honda rep wrote me. “Toward that end, the company’s public websites prominently feature a link to our privacy practices, which include provisions allowing consumers to opt out of the collection of certain types of information.”

When I tried asking more direct questions about what was collected, the Honda representative kept pointing me back to the company’s unreadable privacy policy. 

Concurrently I’d sent out requests to data broker LexisNexis to look at my and my husband’s files. Fortunately, it didn’t seem to have turned up anything about our driving — just former addresses, phone numbers, property records — though it’s unclear if that’s because our car only had data collection on for a month. 

The Times’ Hill was less lucky (as a civilian, more lucky as a reporter). She found out that she and her husband’s Chevy Bolt had been sending detailed information about their driving habits — speeding, accelerating, stopping too fast — to data brokers and then on to insurance companies.  

EFF’s Klosowski likens car’s unbridled data collection to smartphones around 2010 or internet of things devices (that were constantly being hacked into) soon after. A mix of state and federal legislation have helped but privacy problems persist. 

“It used to be worse, which is a fun thing to think about,” he said.

“We have found ourselves in similar situations before and we did, slowly but surely, push on these companies to make improvements,” Klosowski said. “Car makers have less of an excuse given the fact that the history of smartphones and IoT products are right there to learn from.”

Last year, US Sen. Ed Markey sent a number of questions to car companies trying to suss out more clearly what they collect and where it goes. Recently their responses came out, but they’re not exactly transparent. Markey has since sent a letter to the FCC asking them to investigate automakers sending car location data to police. It’s part of increasing government attention on the car-data industry. But for now the freedom of the open road doesn’t feel really free.