The interior of our cars is considered a private sanctuary – home to private conversations, work phone calls, debate, and family arguments.
In the past, a strong window tint was enough to safeguard this private space. However, in today’s digital world and tech-laden vehicles, are our cars private anymore?
Today, cars have become more connected with the penetration of smartphone mirroring, always-on facial recognition cameras, and even carmaker’s own voice assistants always listening for the magical “Hey Mercedes” or “Hi BMW” hotword.
The interior of our cars are no longer private.
Media and communication associate professor Nicholas Carah from The University of Queensland (UQ) argues, “The car is interesting in that it just sort of reminds us what’s happening is that everything is being plugged in, that platforms want to plug everything into their data collecting and processing kind of architecture. And the car is like the next frontier of that.”
“It’s going to be reimagined as much less of an object you buy and drive away, and much more a data-driven service that you subscribe to. And we’re really on the cusp of it.
“Media deliveries have been a part of the car for a long time via the radio. Platforms are looking to the car as a side of delivering information, but also a side of data collection. They looked at our homes like that,” he explains.
Now, automakers seem more like technology companies – developing new infotainment systems, safety features, and voice assistants to attract our attention and money.
Therefore, brands are also collecting data from an array of sensors, microphones and cameras built-in to their own vehicles.
We consciously agree to this data collection through seemingly endless terms and conditions that can be accepted in a matter of seconds without hesitation.
But like tech firms, what data is collected, how that data is used for and who sees it – beyond improving its own services – is vague and unknown. It’s pervasive and that’s problematic.
How have cars ‘mediatised’?
Mediatisation refers to how society in all sectors of life have been shaped or influenced by digital media technologies, including the advent of the internet and big tech platforms like Facebook, Apple, Amazon, Netflix, and Google.
Subsequently, this has led to the datafication of car interiors; the ability for carmakers and tech giants alike to collect data and metadata to improve their own services, deliver personalised recommendations for users through machine learning and algorithms, and sell or capitalise data for marketing or to third parties.
A plethora of screens, sensors, cameras, microphones and other Internet-connected features are constantly expanding to new cars today – from an affordable Kia Picanto to a premium Rolls Royce Cullinan SUV.
Here are just some examples of how cars have mediatised:
- Infotainment systems – central hub for media while driving, operate HVAC in some models, download and store phone contacts and call logs using Bluetooth, and augment digital driver instrument clusters
- Smartphone mirroring – Apple CarPlay and Android Auto projects basic phone functions to infotainment displays via a wired or wireless connection, enabling Apple and Google to collect data
- GPS – built-in navigation, for emergency services, and vehicle location tracking
- All-round exterior cameras – now used as ‘dash cam’ recording systems in addition to safety tech
- Always-listening microphones – for summoning voice control assistants, recording voice memos on some models, and phone calling
- Facial recognition cameras – driver monitoring cameras to alert inattention and enable individual driver profiles matched to favourite radio stations and set seat position
- Internet-connected – SIM cards deliver online infotainment services and applications, and enable mobile remote apps to control and monitor vehicles via connecting to 4G or 5G cellular networks
- Digital smartphone keys – allowing smartphones and smartwatches to access and start vehicles via near-field communication (NFC), Bluetooth or other sensors as seen with Apple CarKey (can use U1 proximity chip)
- Gesture control sensors – to operate and interact with the infotainment system
- Sensors on steering wheels – to know if a driver is touching the wheel and attentive for lane-centring, adaptive cruise control and driver monitoring systems
- Car monitoring systems – tyre pressure monitoring systems display air pressure of each tyre, analysing how hard the accelerator and brake pedals are pressed, auto-sensing windscreen wipers and headlights, and so on
These are controlled by Telematics Control Units (TCU) in each car which gather, interprets, and disperse data to operate essential electronic functions.
As is the case with social media and mobile technologies, consumers sell their attention and information to companies in order to use convenient and free services. Yet, we can consciously accept terms and conditions in a matter of seconds – often without reading.
And, let’s not forget that the same always-on, always-listening and always-connected smartphones, smart wearables, and tablets enter into the car with each person, too.
This digital disruption outside of the car has proliferated surveillance capitalism, where tech companies and platforms monetise on the behaviour and activities of its users in inconspicuous ways.
Why should I care?
Author and scholar Shoshana Zuboff defines surveillance capitalism in an interview with The Guardian as a “titanic struggle between capital and each one of us. It is a direct intervention into free will, an assault on human autonomy”.
Thus, what connected car owners risk is simply privacy from companies that monetise personal and vehicle information.
According to TomTom, personal driver information may include:
- Hard data – name, addresses, gender, age and other personal details when consensually signing up an account to use mobile vehicle remote apps or the navigation
- Audio – recording snippets when voice assistants are activated
- Driver behaviour – facial recognition cameras measuring driver attention, individual’s personal infotainment settings and more
Additionally TomTom states vehicle information collected can include:
- Technical data – fuel consumption, the odometer, oil levels, engine temperature, and more
- Location data – real-time or saved GPS on where the vehicle is located
- Surrounding data – sensors and cameras monitoring the environment to collect information about road surface, curvature, gradient, traffic signs, measuring distance and speed of other cars
- Driver digital traces – metadata including distances, vehicle model, which mobile devices are connected, selected buttons, and infotainment session times
But, how can this data be capitalised?
“If data were to fall in the wrong hands, this could have a troubling impact on someone’s privacy,” says Cassandra Moons, TomTom’s privacy legal counsel and data protection officer.
“Imagine an insurance company going beyond this point by using this data to offer users who drive safely and take care of the environment different premiums via personalized connectivity.
“Or a tech company that could go even further and use this data to build profiles about someone’s mental state.
“Companies could even sell this ‘behavior surplus’ to predict stressed drivers’ origins and destinations. This information could be sold to third parties for multiple data stack location-based advertising via multimodal live connectivity,” Moons warns.
Carah adds, “As data that’s being collected from thousands of drivers on trips every day, it begins to reveal patterns that are really valuable to car manufacturers but particularly valuable to the third parties who they sell that data to.”
“Insurance at the individual level might affect your individual premiums, but at the population level it might begin to affect what groups are preferred or offered insurance by companies and what groups tend to pay more and not be offered policies at all.
“This is probably speculative because there are ways in which we can see the cars collecting this data, but no one really quite knows the data sharing agreements are quite proprietary, they’re quite secretive,” he says.
Is smartphone mirroring tech private?
Since the emergence of Apple CarPlay and Google’s Android Auto smartphone mirroring features in 2014 – arguably a significant turning point for the automotive industry – carmakers have been concerned at the data tech giants are collecting.
According to Reuters, Ford, the Volkswagen Group and General Motors were concerned at losing control of their own infotainment systems.
A Volkswagen spokesperson told Reuters that Apple and Google “asked for more data than we were willing to share”, but the automotive conglomerate is providing access to “data points that are important to providing the best apps performance and user experience”.
However, it is evident there is more concern among carmakers that Google is collecting more data than Apple.
In fact, since 2016, Porsche has persisted with only featuring Apple CarPlay, despite other brands in the Volkswagen Group implementing Android Auto.
A report by MotorTrend says Porsche feared Google was collecting too much data, essentially comprising what an on-board diagnostics II (OBD2) tool could collect – vehicle speed, throttle position, coolant and oil temperature, engine revs and more.
A Google spokesperson defended to The Guardian, “Users opt in to share information with Android Auto that improves their experience, so the system can be hands-free when in drive and provide more accurate navigation through the car’s GPS”.
In contrast, the MotorTrend publication claims that Apple only wants to know if the car is “moving” while CarPlay is in use.
Further controversy ensued in 2018 after Toyota refused to implement Google’s Android Auto in its cars due to, again, privacy concerns.
“We’re a conservative company and we wanted to make sure everything was okay,” Toyota Avalon executive program manager Mark DeJongh told Motor1.
“We wanted to protect our customers privacy. We strongly believe in our stance and in what we’re doing,” he says.
Of course, Toyota and Lexus relented in 2019. Most models in both line-ups now offer Apple and Google smartphone mirroring tech as standard – it’s deemed an essential feature in any new car nowadays.
But, Apple isn’t immune. Last year, the Cupertino giant apologised for its “Siri grading program” that allowed some contractors to listen and review voice recordings when the assistant was triggered.
Recordings ranged from personal medical details, to drug deals, intimate moments, and more – especially worrying when the voice assistant can be accidentally triggered by always-listening microphones mistaking that the “Hey Siri” hotword has been said.
Furthermore, with the recent unveiling of the iOS 14 software for iPhones, Apple Maps can now track an electric vehicle’s state of charge, plus CarPlay can also support new apps such as parking, electric vehicle charging, and food ordering.
Apple could now further mediatise the car via the infotainment system, and extract data like electric car battery percentages and transactions (linking with Apple Pay).
Essentially, big Silicon Valley tech companies increasingly exert their power by entering the automotive industry market to expand its data collection.
“Wherever they started out – Amazon started out with books, Netflix started out with movies, Facebook started out as a social network, and Google started out with search – they expand outwards from there, because what they really are is engineering companies. They engineer the collection and processing of data,” explains Carah.
“These are really expansionist companies and they see cars as an important frontier, partly because cars capture so much.
“There’s sorts of spill-overs like if you’re driving a car that has Android, then effectively your car becomes part of the architecture of training Google Maps to predict things like how fast traffic moves, at particular days of the week or times of the day, and which routes are the most efficient through the city and that kind of stuff.
“So, the data that your car collects spills out into the larger platform economy,” he says.
Along with the proliferation of smart wearables, accessories such as the Amazon Echo Auto, brands such as Volvo Cars giving full infotainment control to Google by using Android Automotive software, and even automotive acquisitions by tech companies like Amazon, mean big tech’s grasp on the car will only further expand.
Are loan cars safe?
Whether you’re using a loan car while your vehicle is being serviced, renting a car for a holiday or using car sharing services in cities like GoGet or Popcar, there’s even more concern.
According to a 2017 study by Privacy International, customer data generated by connected cars is now seen as a major source for automakers and their partners.
Car data is more valuable than what mobile devices collect today; both quality and quantity.
This is especially worrying for loan cars that are temporarily used and passed on to other drivers.
Many carmaker’s own proprietary infotainment systems now run a tweaked version of Google’s Android software – including Hyundai, Honda, and soon Renault-Nissan-Mitsubishi.
“You switch on the Bluetooth and see a list of other people’s phones that were previously connected – Mike’s iPhone, Samsung Galaxy, Bikerboy_Troi, Dee Dee. You input your journey into the navigation, perhaps noticing stored locations of previous drivers,” Privacy International visualises.
“Your name and navigation history is valuable personal information. The UK Metropolitan Polices’ ‘Digital Control Strategy’ identifies infotainment systems in cars, which store this information, as a new forensic opportunity.
“Cars, still considered private places, are the next gold rush for data miners, with a variety of different companies hungry for your data.
“Privacy International believes that people are given little information or choice on how they can safeguard their information, particularly in relation to the most basic of protections: protection from other car users, whoever they may be,” it states.
Additionally, the organisation recommends rental and car-share companies be more transparent in stating what data is retained on infotainment systems, and car manufacturers should provide a delete button to easily remove personal data stored on infotainment systems.
“Both the rental companies and manufacturers put the onus on individuals to delete data held on infotainment systems, there is no agreement who is the data controller of the information which resides on these devices,” Privacy International reveals.
“This is concerning, particularly as infotainment systems become increasingly sophisticated and they attract the attention of law enforcement and potentially criminals.
“While we also questioned rental companies and manufacturers about telematics units, the responses were not particularly informative
“They [rental car companies] later clarified that they are working on a new policy for the customer data protection and are very committed to cover all matters as required by the new General Data Protection Regulation (GDPR).
“A more positive initial response came from Thrifty who stated that whilst currently they expect customers to remove data prior to returning it, they are creating a policy as part of GDPR implementation,” it reveals.
The privacy policy jungle
In today’s digital world, this invasive data collection can be accepted by any user in a matter of seconds without reading seemingly infinite paragraphs of privacy policies and terms and conditions.
Carmakers that use Internet-connected services and voice control assistants do give users a privacy policy prompt upon first setting up the vehicle or in the display’s settings menus.
Kevin Litman-Navarro from The New York Times says privacy policies are “verbose and full of legal jargon – and opaquely establish companies’ justifications for collecting and selling your data”.
However, Litman-Navarro does concede the European Union’s (EU) GDPR law is somewhat clarifying these policies (as seen with car rental companies). The policy was enacted in 2018 to improve the transparency and limit the power of organisations’ data collection practices, in addition to imposing severe fines in breaches.
Any business must abide by the GDPR if they operate or have affiliations within the EU – which includes nearly all automakers in Australia. Locally, businesses must also comply with the Australian commonwealth’s Privacy Act 1988.
For example, the Mercedes-Benz South Korea website stipulates in its privacy statement that it does send audio data to a third-party provider, Nuance Communications – and may be stored in its servers for up to 10 years “from the member terminating his/her account for the purposes of preventing, settling, responding to, and managing legal disputes”.
That data is anonymised when the Mercedes-Benz User Experience (MBUX) voice control is activated to “improve speech recognition”. Personal data such as voice profiles and uploaded call contacts are stored by the German automaker for “no longer than three months after the last request”.
However, users will need to navigate through more than 16,000 words and nine different main sections in Mercedes’ privacy statement to find this.
According to a 2018 study by the Consumer Policy Research Centre, a staggering 94 per cent of Australians say they don’t read privacy policies or terms and conditions at all when signing up to such services (out of 1004 surveyed).
Thus, the data collection in our ever-connected vehicles can be consciously accepted in seconds to avoid reading endless and complex policies, plus quickly gain access to vehicle features.
How can I combat this?
Much of this data collection in vehicles is driven by cellular network SIM cards for Internet-connected services and features.
The Internet enables the big data collection from vehicles to be sent wirelessly to the respective car manufacturer or tech firm, which can then be sold to third party companies. Though, non-connected features like downloaded phone contacts, driver profiles and more can still be extracted manually from infotainment systems.
Without being too paranoid, there are ways to circumvent this data collection – simply turn things off.
Most infotainment systems like MBUX allow drivers to turn off Internet-enabled services like its “Hey Mercedes” Linguatronic voice controlling in the settings menu.
This will disable commands that require the Internet such as asking the weather or querying facts, but users can still operate offline functions such as closing the sunroof or changing the HVAC.
Ditto, Subaru’s camera-based driver monitoring system can be disabled with a push of a button beside the stop/start, traction control, and safety assist toggles.
In both cases, however, opting out means the driver has to sacrifice functionality that’s convenient or, in some cases, enhances safety.
Turning off Bluetooth on your phone and in the vehicle infotainment settings, not allowing cars to download smartphone contacts when prompted, and not using Apple CarPlay or Android Auto are also options – despite being a fundamental aspect to our cars today.
On smartphones, users can opt-out (if already enabled) for automatically sending feedback data logs to tech companies in settings menus, like with the Google Assistant.
At the physical level, some models can allow owners to eject the SIM card to disable all Internet connections with the car, although you are robbing yourself of some attractive features in the process.
Keep in mind that these are still not concrete solutions. How and when car manufacturers collect data is rather nebulous and unknown.
What does the future hold?
With more cars becoming more tech-laden, Internet-connected with the development of 5G technology, automated and electrified, the mediatisation and datafication of cars will further expand.
UQ associate professor Nicholas Carah anticipates that car interiors will further mediatise with the entrance of in-car advertising, targeting drivers based on location.
“I think you can anticipate that ad products will start to get built into that digital experience of the car. But, they’ll be very kind of locative and temporal, very logistical,” Carah says.
“What they’ll be customised to is not just you as an individual as a consumer and your preferences but customised to where you are and where you’re going in the car.
“We might be driving somewhere and Google Maps will have a paid prompt like ‘hey you’re driving past that café’.
“The TV kind of got superseded by the smartphone and the tablet, and now it’s the car, it’s the car’s turn to be kind of reimagined for the platform economy,” he argues.
Additionally, Carah also explains that the emergence of the pure-electric, tech-focused Tesla brand is a symbolism for the digital disruption in the car industry.
“When the traditional car manufacturers are adapting themselves to the platform economy, integrating these digital systems into the car as a kind of object they’ve made for years and years, Tesla is sort of born native in this economy.
“Tesla’s a bit like Amazon in the 90s – everyone’s like ‘is this ever going to work, is this company ever going to be profitable?’ But what they’re doing regardless of that is they’re definitely disrupting the traditional car industry, so you can see all sorts of ways around, not just the electric car, but sort of reimagining the car as a subscription software service that Tesla has kind of introduced to the mindset of the market.
“By 2030, probably, not only will all new cars be electric, but they’ll all be kind of this plugged-in data-driven kind of object as well,” he envisions.
It is clear that the privacy of our car interiors is no longer limited to just applying mere window tint anymore – the automotive industry has rapidly mediatised and datafied.
