In Privacy Not Included Mozilla reveals that deeply personal data, including sexual activity, facial expressions, genetic and health information is harvested.
What is going on is the digital equivalent of dogging on an industrial scale.
But it also has a buyer's guide (a bit like Which, perhaps, but dedicated to privacy) and wearing this hat the foundation tested vehicles including BMW, Ford, Toyota, Tesla, Kia and Subaru.
As well as sexual activity, the data collected included race, facial expressions, weight, health and genetic information. It also tracked the more mundane, where the vehicle was driven to.
"Researchers found data is being gathered by sensors, microphones, cameras, and the phones and devices drivers connect to their cars, as well as by car apps, company websites, dealerships, and vehicle telematics," said Mozilla.
As well as plain snooping, the data enables the motor manufacturers to tailor their marketing since they know a lot more about you, the customer.
"Many people think of their car as a private space — somewhere to call your doctor, have a personal conversation with your kid on the way to school, cry your eyes out over a break-up, or drive places you might not want the world to know about," says Mozilla's Jen Caltrider. "But that perception no longer matches reality. All new cars today are privacy nightmares on wheels that collect huge amounts of personal information."
Many car brands engage in privacy washing, the act of pretending to protect consumers’ privacy while not actually doing so, says Mozilla.
Several have signed on to the automotive Consumer Privacy Protection Principles, the foundation says. But these principles are nonbinding and created by the automakers themselves. Signatories don't even follow their own principles, like Data Minimisation (i.e. collecting only the data that is needed).
Consent to collect personal data is presumed by simply being a passenger in the car. For example, Subaru states that by being a passenger, you are considered a user and by being a user, you have consented to the privacy policy. Several car brands also note that it is a driver’s responsibility to tell passengers about the vehicle's privacy policies.
Jonathan Brind