Smart Cars Share Driver Data, Prompting Calls for Federal Scrutiny

Two US senators accuse carmakers of deceptive language and shifty practices in sharing and resale of driver data.

Two US senators have called on the US Federal Trade Commission (FTC) to hold automakers accountable for sharing driver data without consent, highlighting the growing data privacy challenges — and deceptive verbiage from terms of service — associated with modern smart cars.
In a
letter to the FTC
(PDF) last week, Sens. Ron Wyden (D-Ore.) and Edward Markey (D-Mass.) used the data-sharing practices of General Motors, Honda, and Hyundai as symptomatic of an industrywide problem that needs immediate investigation.
All three vendors collected and sold driver information such as acceleration and braking data to Verisk, a data analytics company that used the information to prepare driver behavior reports that it then resold to insurance companies. By their own account, none of the automakers obtained informed consent from customers before sharing their information. Instead, they deliberately obscured their data-sharing relationship with Verisk in lengthy disclosures and made deceptive claims about how they would use driver data, the senators charged.
The FTC should hold accountable the automakers, which shared their customers data with data brokers without obtaining informed consent, as well as the data brokers, which resold data that had not been obtained in a lawful manner, their letter noted. Given the high number of consumers impacted, and the outrageous manipulation of consumers using dark patterns, the FTC should also hold senior company officials responsible for their flagrant abuse of their customers privacy.
The letter highlights just one aspect of what many say is a rapidly growing set of
security and privacy issues
around modern, highly connected
software-defined vehicles
. While such vehicles offer increased automation, autonomous capabilities, and highly customizable user experiences, they also collect an enormous amount of data that can be hard to
protect and secure
.
Your vehicle knows your name, your home address, your debit/credit card info, how fast you drive, how hard you brake, what you ask its voice assistant, the locations you frequent and at what times, says Riley Keehn, lead regulatory and government affairs consultant for SBD Automotive, an automotive research and consulting firm. Certain occupant detection and automated driving cameras and sensors can even see you and your surroundings.
The onboard storage of this sheer volume of personal and identifying information (PII) and sensitive data types make drivers and their vehicles the direct targets of cyberattacks. These attacks can happen via hardwired systems like the OBD-II port or even the headlights, connections to the vehicle via shared and insecure Wi-Fi networks, through electric vehicle charging stations, compromised aftermarket components, and other means, Keehn says.
Some of these risks can be addressed via security-by-design approaches and the implementation of industry best practices and regulations, such as UN R155 on Cybersecurity Management Systems (CSMS) and UN R156 on Software Update Management Systems (SUMS), ISO/SAE 21434:2021 on Cybersecurity Engineering for Road Vehicles, and other international and regional requirements, she notes.
But where things can get messy is what happens to personal data after a vehicle collects it. The US still lacks a comprehensive, general data privacy regulation comparable to the EUs GDPR, Chinas PIPL/DSL/CSL framework, and other global regulations that have adopted the GDPRs model and stringency, Keehn says.
The US largely relies on sector-specific regulations, such as HIPAA in healthcare, to address unique data privacy and security requirements. Individual states have filled that gap with their own data privacy laws, creating a patchwork of inconsistent rules, often exempting certain sectors and technologies. While some states may have clear requirements for how an original equipment manufacturer (OEM) must handle the storage, collection, sharing, and sale of data, other states may have different requirements or none at all, she says.
This inconsistency and lack of national guidance in the US creates a host of risks at the business level and can foster an OEM culture where security stops with the vehicle, Keehn adds.
David Brumley, CEO of software security firm ForAllSecure, says car companies should be required to ask for informed consent from drivers to share their information for advertising or for any other purpose not specific to delivering a required feature.
Over-the-air software updates? Probably being served from Amazon or Google. Maps? Probably from a third-party. Accurate position? Its not just GPS; often its assisted with other metadata — like Swift Navigation — to increase accuracy, Brumley notes.
A car vendor might require some data, like location information, for instance, to provide services such as roadside assistance, traffic warnings, and autonomous driving. So there needs to be separate consent requirement for sharing such data and for sharing data for pure profit reasons, he says. Second, we need a law that says companies must not limit functionality when someone opts out, he adds. Someone shouldnt be able to force your consent so you can keep driving to work.
Brumley says its unrealistic, however, to expect the FTC to drive much change. They dont exercise their regulatory powers in other domains, and instead rely on free-market dynamics, which wont help here, he says. Where we may get a bump is EU regulations, which tend to be stricter. We also need consumers to speak up that it impacts their buying decisions.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Smart Cars Share Driver Data, Prompting Calls for Federal Scrutiny