Many New Cars Are a Data Privacy Nightmare, but Tesla's EVs Are the Worst

Today's vehicles can do much more than take from A to B. The computers found in some of the latest models are so powerful that they can run video games. But that's not all. Most new cars on the market can connect to the Internet and give drivers various up-to-date information about things like weather and traffic. They can even allow the driver (when stationary) or the passenger (at any time) to stream movies.

Take the Tesla Model X or the BMW 7 Series as an example. These vehicles attract different types of customers but offer similar ways to remain online or enjoy stuff previously only possible on a desktop computer or laptop. Add the advanced driver-assistance software (ADAS), the many remote functions, the interior and exterior cameras, the sensors, the microphones, the personal assistants, the subscriptions, and things like a marketplace for apps, and one can quickly figure out that a lot is going on.

Some people innately care about privacy, which is typical in a free society. Yes, we're using IDs and driver's licenses. We also give our biometric data to phone companies to enhance the security of our mobile devices. On top of that, we do not care much about remaining private in public areas or giving our personal information to banks and companies we do business with.

However, most people don't want someone (be it a database or a stranger) to know every little thing about their day-to-day lives. It happens more often than you might think!

There are exceptions, though. Some drivers, for example, are okay with sharing their driving habits and location with insurers to obtain lower premiums. Some even respect suggested curfews for the same reason!

Maybe think twice about all those techy perks

But what's worse about manufacturers and personal data is that they know customers don't really care about this stuff. Nobody's in the mood to read tens of pages of documents featuring weird terminologies and legal jargon when they see their new car awaiting them. Furthermore, most people don't associate vehicles with data collection. It's a bit of a fiasco in the US. Over the pond, the European Union (EU) has the General Data Protection Regulation that includes hefty fines. They can bankrupt companies that break the rules repeatedly or do it just once but do so colossally badly.

Last year, we told you about what information Mazda's telematics unit collected about the car. The Japanese automaker isn't the only one doing this. But one thing that attracted our attention: it was an opt-out system, not an opt-in. The latter would have given buyers the opportunity to decide if they wanted to help Mazda learn more about their customers.

But Tesla has blurred the lines of what customers may deserve to know with the Full Self-Driving Beta public testing. Not only has the brand given these enthusiasts unfinished software to test on their own cars and at their own risk, but it has also made them pay for it.

Surprisingly, however, a recent study revealed that new car buyers aren't so keen on sharing their data. Less than half of those polled by Deloitte would let companies know more about them in exchange for updated software. Still, it's happening – and at a large scale!

Looking into it

Mozilla decided to start a project that features how certain entities treat data in an online and increasingly connected world. Known as "Privacy Not Included," the initiative looks at how companies or individuals providing services or entertainment deal with their customers' data.

To make sure they're not digging too deep, the researchers look around for publicly available information. Mozilla consults things like "privacy policies, company websites, news reports, research whitepapers, app store listings, consumer reviews, and anything else" that's trustworthy and readily available. It's a correct approach. Most customers don't have all the time in the world to read everything. If privacy (or any other subject) matters, they'll do a quick search, read a summary, or glance over the documents and call it a day.

When the organization concludes that an entity doesn't take data privacy seriously, it applies the "Privacy Not Included" warning label.

Mozilla's latest analysis is about cars. "Researching cars and privacy was one of the hardest undertakings we as privacy researchers have ever had to do," explained the foundation. They spent over 600 hours looking into the most popular 25 automotive brands from North America and Europe. Sadly, all received the "Privacy Not Included" warning label, but Tesla is the worst of the bunch in this respect.

Mozilla found that:

• all collect too much data about consumers;
• most share or sell the collected data;
• most don't give customers enough control over their personal data;
• none have clear explanations regarding securing this data (i.e., encrypting what's sent from the car to the company's servers).

Some other peculiar stuff revolves around Kia and Nissan which admit they will collect data about any intimate contact that happens in their vehicles. Weirdly, Hyundai takes things a step further and underlines that will hand over customer data to authorities even when informal requests are made.

Ranking the manufacturers that don't take your data seriously

To give us a better look at how things stand, the organization, which also provides netizens with a popular browser known as Firefox, stacked the brands up. They created five categories where automakers could fail: data use, data control, track record, security, and artificial intelligence (AI).

Tesla is the only one to tick all the boxes.

However, the highlight regarding Tesla is confusing. Mozilla says it failed in the AI category because the advanced driver-assistance system known as Autopilot was involved in "17 deaths and 736 crashes and is currently the subject of multiple government investigations."

That's an alarm sign, we agree, but what has that to do with privacy worries? Suppose Autopilot is a concern because of not being too safe. In that case, we should have seen a breakdown of how many miles Tesla customers completed while the ADAS was active and how many crashes or deaths resulted from using this suite.

But, alas, the extended analysis reveals that:

• employees were mishandling the videos (which in some instances included children, nudity, or sensitive images recorded by the cars;
• whistleblowers released massive amounts of confidential data to third parties that included customer, employee, and business details;
• enabling data sharing (which is the opt-in system we mentioned above, so it's a good thing that this option is available) will send audio-video recordings to Tesla's servers;
• tesla uses personal information for advertising and marketing;
• the automaker tied opting out of any data collection with losing access to over-the-air (OTA) updates and other remote or in-car features;
• Tesla contradicts itself when it comes to customers requesting the complete deletion of their data;
• Tesla will share anything about you with law enforcement (but that's something almost all companies will do).

However, one good thing about Tesla is that it doesn't sell or rent its buyers' data to other companies.

Mozilla advises Tesla customers who care about their privacy to disable segment data collection and opt out of things like "Cross-context Behavioral Advertising" or any other such policies that won't completely brick the car and make it just a battery pack with wheels and a steering wheel.

Ultimately, Tesla's tremendous amount of data collection and improper data handling, breaches, and vague privacy policies put them at the bottom of Mozilla's list.