Modern vehicles have become complex digital hubs that constantly track and record what you do.
Those are the findings published in a new report by Quebec’s commission on ethics in science and technology.
“We wanted to map out the risks and challenges associated with connected vehicles,” said Luc Bégin, president of the commission. “Today’s cars are essentially computers on wheels.”
Many smart or connected cars have sensors, cameras and microphones collecting data both inside and outside the vehicle.
The 64-page report identified 12 major privacy risks, including cybersecurity, location tracking and unfair insurance practices.
“The Mozilla Foundation, in 2023, concluded that today’s vehicles are the worst category of products it has evaluated in terms of privacy,” said Bégin.
For example, “safe driver” insurance programs track drivers in exchange for discounts, but they can be highly unfair, says the latest report.
Computer algorithms often penalize people who drive at night or travel through specific neighbourhoods, which raises insurance rates for low-income shift workers. Insurance companies don’t disclose how clients are scored, preventing them from disputing a bad score, the report says.
Data collected by vehicles is stored on external cloud servers run by third-party providers. The report says each point of transfer and storage is a potential target for hackers, and there is a lack of transparency on how the data is protected.
This could even lead to national security issues, said Bégin.
The report points to a massive security failure in 2024 where an Amazon Web Services (AWS) cloud database was left unsecured, exposing the GPS history and sensitive information of roughly 800,000 Volkswagen electric vehicles to the public for months.
Location data can be dangerous in the wrong hands, Bégin said, as the report raises concerns around domestic violence and coercive control. Abusers can use car location apps to secretly and invisibly track, stalk, and control their partners, the report notes.
Researchers found many are not aware of the risks as only about 7 percent of consumers read the terms and conditions, which are “excessively long,” vague and difficult to read.
“There is a great deal of opacity surrounding this issue right now,” said Bégin. “Yes, the person consents, but does the person always fully understand what they’re consenting to? And what are the potential consequences of that consent?”
The report concludes that the classic model of individual consent is “fundamentally broken” in the connected vehicle ecosystem.
Bégin said cameras from connected vehicles also record bystanders and passengers who are unaware they are being recorded.
In some cases, location data can be used in criminal trials. Prosecutors in Upstate New York used data from a vehicle to convict Luciano Frattolin of murdering his daughter, who lived in Montreal, earlier this month.
“You can see it as a public benefit, just as you can also see it as a risk of excessive surveillance. So it all depends on how it’s used,” Bégin said.
“The question of balance, for me, isn’t so much about whether the benefits outweigh the drawbacks or risks. I think it’s much more nuanced.”
The report recommends increasing government oversight, enhancing data systems and monitoring international developments to evaluate and update protocols.
Bégin acknowledged there are benefits to smart cars. These include having real-time alerts warning about accidents on the road, and diagnosing mechanical failures and breakdowns to prevent accidents.
But because many skip reading the terms and conditions, he said it’s crucial people be aware of the risks to make informed decisions.
