25 Major Car Brands Fail Security and Privacy Test: A Wake-up Call for the Automotive Industry

25 Major Car Brands Receive Failing Marks for Security and Privacy

Overview

Mozilla, the non-profit organization behind the popular web browser Firefox, recently conducted an analysis of 25 major car brands and found that all of them received failing marks for their privacy and security practices. The analysis revealed that these car brands collect significant amounts of personal data, which can be shared or sold to third parties without customer consent. This raises serious concerns about the protection of customer information and the potential misuse of sensitive data.

Data Collection and Sharing

According to Mozilla’s analysis, the privacy policies of these car brands disclosed the collection of a wide range of personal data, including health and genetic information, race, immigration status, weight, facial expressions, location, driving speed, multimedia content, and even sexual activity. This data is collected through various sources, such as mobile apps, dealerships, company websites, vehicle telematics, sensors, cameras, microphones, and phones connected to the vehicle.

Furthermore, the study found that more than half of the car brands’ privacy policies allowed for the sharing of collected information with law enforcement and other government agencies. Additionally, 84% of the brands stated that they can share personal data with service providers, data brokers, and others, while 76% indicated that they can sell the harvested personal data.

Ranking of Car Brands

Mozilla ranked the car brands based on data use, data control, track record, and security. Renault and its subsidiary Dacia, European companies required to comply with the EU’s General Data Protection Regulation (GDPR), were ranked as the best among the analyzed brands. They demonstrated better data protection practices compared to their counterparts.

On the other end of the spectrum, Nissan and Tesla received the worst rankings. Nissan was criticized for collecting “creepy” data about users’ sexual activity, while Tesla was flagged for failing every privacy and security check and using what Mozilla described as “untrustworthy AI.”

User Consent and Control

One concerning aspect highlighted by the analysis is that car manufacturers often presume customer consent to their privacy policies simply by being a passenger in the vehicle. Some brands even place the responsibility on the driver to inform passengers about the vehicle’s privacy policies. This lack of explicit consent and control over personal data raises questions about the extent to which consumers have agency and autonomy over their own information.

Mozilla’s Concerns

Mozilla expressed deep concerns about the amount and sensitivity of personal information being collected by car companies. The organization emphasized that based on their track records, these companies cannot be trusted to keep customer data safe. Furthermore, Mozilla believes that the sharing and selling of personal data primarily benefits the businesses seeking to profit from it, rather than benefiting drivers or individuals.

Moreover, Mozilla warned that advancements in sensor technology could enable car companies to collect and monetize even more information about individuals. This raises concerns about the potential erosion of privacy and the exploitation of personal data for commercial gain.

Recommendations and Future Outlook

Given the alarming findings of this analysis, it is clear that stronger regulations and oversight are needed to protect consumers’ privacy and ensure better security practices in the automotive industry. Regulators and policymakers must catch up with the evolving landscape of data collection and use in connected vehicles.

Consumers should also be more aware and vigilant about the privacy practices of car brands before purchasing or using their products. Reading privacy policies, questioning data collection practices, and advocating for transparency can help individuals make more informed decisions about their privacy and security.

Ultimately, the automotive industry must prioritize customer privacy and security to foster trust, protect sensitive information, and maintain ethical standards. Car manufacturers need to implement robust privacy frameworks, obtain explicit user consent, limit data collection to what is necessary, provide clear controls for users, and establish strong security measures to prevent unauthorized access to personal data.

Sources:

1. Eduard Kovacs, “25 Major Car Brands Get Failing Marks From Mozilla for Security and Privacy,” SecurityWeek, September 6, 2023.