PSA: Modern Cars Can Legally Store Your Texts and Call History Permanently

Right as I was looking over the details of these cases, a moment from the TV shop "The Sopranos" popped into my mind. De facto New Jersey mob boss Tony Soprano buys a 2003 Cadillac Escalade ESV and shows it to an acquaintance. After pointing out some of the cool features the full-size SUV had, the protagonist says that he immediately disabled the built-in global positioning system (GPS) because he didn't want to be tracked down by "the feds."

In the real world, most of us aren't involved in shady stuff or members of the Cosa Nostra. But that doesn't mean we don't care about privacy. If we didn't, then we would have been fine with mass surveillance, snitching on neighbors to law enforcement, digital cash, social credit, and who knows what other Orwellian measures.

Fortunately, we are not okay with having our lives strictly controlled and under the supervision of some unelected entities. Freedom is embedded in the American way of life, and that does not include arbitrary restraints. It also means that we like to keep some things private. We have the liberty to share secrets or personal stuff with whomever we want or not do it at all.

However, in the connected era, it's becoming increasingly more challenging to keep stuff for yourself. Free apps treat you like a product and use large amounts of your own data to feed you ads. Or, they sell that information to someone else that's interested in up-to-date consumer behavior.

Unless you intentionally choose to use a dumb phone like what the revived Finnish company Nokia currently sells, not be present on any social media, and not use the free versions of platforms like YouTube, a server somewhere contains some details about you.

Getting to know you

The good news is that common practice does not dictate that you should always be identified with your personal details. Most often, your Internet habits are collected under an anonymous profile that usually has a randomly generated nickname. Even though a company might suggest personalized ads, it doesn't necessarily know that you're John or Jane Doe. Nefarious actors might find out, but not brands that abide by the law.

But while such practices might be acceptable when using various free apps, it makes very little sense to have it happen with your car. The argument here is simple: this is a thing I paid for; hence, I must be able to do with it exactly as I please and not have to worry about an incorporated entity treating me or my data as a product.

However, nowadays, things are tricky even with cars. Modern automobiles encompass a plethora of safety features, driver-assistance systems, and connected applications. The latter allows us to know more about our cars, use various cool features like remote control, take advantage of cameras recording the vehicle's surroundings, and track it easily whenever it's parked in a new area.

But in implementing all these novelties, automakers also decided to answer some regulations a bit too creatively. For example, you can text and answer phone calls without using your phone. Just connect via Bluetooth to your vehicle. You can also enable wireless connectivity for advanced interfaces like CarPlay or Android Auto. Press a button to answer a call or use the voice assistant to respond to a text message. It's convenient and safer.

Unfortunately, some Americans found that certain automakers offer these perks without focusing on privacy. They decided to take the matter to court. Their argument was that their cars' infotainment systems downloaded all the texts and call logs immediately after being connected. Not only that, but they also stored these private details permanently.

A worrisome discovery

That never crossed my mind as something peculiar, but I do remember something similar happening while testing out a BMW 5 Series G30. I only wanted to connect my phone via Bluetooth to answer calls, and iDrive pulled all my texts, call logs, and the contact list. I thought nothing of it at the time because I thought that it was just a simple mirroring job, which I believed meant that data was stored only temporarily. In hindsight, maybe I should have paid more attention to what the car's infotainment system was doing.

That's precisely what these people argued in court. They claimed that modern Ford, Honda, General Motors, Volkswagen, and Toyota vehicles accessed these details and stored them out of sight without consent. The drivers could not see that the text messages and the call logs remained in the system even when the person deleted that data from the phone connected to the car. Thus, they weren't able to get rid of them permanently.

So, they sought damages according to the Washington Privacy Act.

Interestingly, the plaintiffs never said that one of the automakers accessed those messages or call logs. They were worried that third parties could have gotten their hands on that data. Berla Corporation was given as an example. The company makes products available to private investigators, law enforcement, the military, and other regulatory or civil agencies. It has the means to extract information that others cannot.

The lower court told all the plaintiffs they had no chance of success, so the matter eventually reached the US Court of Appeals for the Ninth Circuit. It's worth noting that at this stage, judges don't investigate the facts of the case. They just verify that the District Court applied the law fairly and correctly.

The judges bundled these suits into one and dismissed the plaintiffs' claims. The problem identified by the magistrates was that the buyers couldn't prove that a violation of the WPA led to injuries related to the plaintiffs' business, person, or reputation.

A predictable but unwanted outcome

Long story short, they lost. The judges admitted that a simple invasion of privacy without real-world repercussions wasn't enough to establish guilt that could lead to the plaintiffs receiving damages. What that means is that your data can be stored somewhere else. But until that infringement on your privacy rights does not lead to injuries, as expressed above, there's nothing the courts can do.

The US Court of Appeals for the Ninth Circuit noted that the plaintiffs were given the opportunity to amend their complaint and turn this matter into something that could have led to a different outcome, but they refused to do so.

Practically, as long as your data isn't being mishandled or used to your disadvantage, automakers can allow their systems to store your texts, call logs, and who knows what else. Thought your phone was listening to your conversations? Well, your car might know them in excruciating detail!

Around a year ago, we told you about Mazda's telematics system and questionable connectivity privacy policy. Some of its newer vehicles collect an absurd amount of data automatically. You have to know about it and opt out before taking delivery or buying a used vehicle with this functionality enabled.

Two months ago, an important report showed automakers don't take data privacy seriously in the US. It also uncovered that some brands may even collect data about your intimate moments that happen in one of their cars.

The era of connected services is useful because it allows us to do more with our cars and have relevant data available at a glance.

But it also raises worries about how all these details are stored and handled. Reading everything the selling party is giving you would be a great idea. Or, just keep driving that old car without an infotainment system until it fails beyond repair. It's better for the environment and doesn't store anything about you.