KNOXVILLE, Tenn. (WVLT) – The car you drive everyday could be collecting data on you every time you get behind the wheel, then sending that data to brokers, governments and insurance providers. A WVLT investigation has unearthed some of the things you may not expect your car to collect, along with what rights Tennesseans have about how that data is managed.
In July, the Tennessee Information Protection Act (TIPA) went into place, offering Tennesseans some privacy protections and guidelines for companies to stay compliant.
Even with TIPA in place though, some drivers say there’s cause for alarm and think the state needs to take more action to protect consumer data.
Location information, internet data and even voice recordings are on the list of information car manufacturers collect about their drivers. While each car manufacturer has different user privacy agreements, they often cover the same bases, asking permission to collect more information than the average driver might expect. That said, there’s a way to learn more.
Privacy4Cars is a company that works to showcase what types of information car companies collect. It operates vehicleprivacyreport.com, a tool for drivers to learn more about the data agreements they signed at the dealership.
Drivers can just enter their car’s VIN to get a list of what data is being collected, along with where it could be going. WVLT tested two cars — a Subaru and a Toyota — and pulled examples from the manufacturer agreements themselves.
A common piece of information automakers collect: location data.
Beyond that, Subaru’s agreement said there’s no way to use some car features if drivers don’t consent to sharing personal information:
As for Toyota, its privacy agreement said it collects personal information beyond just identifiers, but also social media IDs and age.
Toyota’s policy also said the manufacturer collects information tied to driver profiles. That includes information like music streaming accounts, saved locations and search history on apps like Google Maps and even preset radio stations.
A major way Subaru’s policy said the company collects user data: drivers’ phones. The agreement said Subaru has the ability to access phone features like cameras, microphones, audio recordings and pictures.
It’s not just the drivers whose information is being collected, though. Subaru said it also collects information from customers’ contacts lists.
Toyota’s privacy policy also said the company would be accessing user phones in order to operate functions like Apple CarPlay and Android Auto.
WVLT’s test with Subaru showed that the company was sending customer information to third party service providers, data brokers, governments and even insurance providers.
When it comes to third parties, Subaru’s privacy agreement said service providers would get access to consumer data to operate those services properly.
Toyota’s agreement is similar, saying the data is shared to help services function correctly.
Data brokers also get a piece of the data pie. Subaru’s privacy agreement said the company discloses personal information to data providers, which is another term for a company that sells user data for a profit. In the agreement’s words, “Data Providers may use Personal Information and Non-Personal Information for their own benefit.”
A specific report for a 2022 Subaru Outback showed that LexisNexis was on the list of companies Subaru shares data with. LexisNexis is one of the largest data brokers in the business, allowing those with paid accounts to access personal information reports on individual people, groups and businesses.
Toyota’s policy wasn’t immediately clear about data brokers, but did say the company shares personal information with “dealer advertising associations,” pointing customers to those dealers’ privacy policies.
Also on the list of Subaru’s data recipients: Liberty Mutual. The manufacturer’s privacy agreement also mentions insurance providers in terms of marketing:
Toyota’s policy is almost identical:
Governments and law enforcement can also access customer information from car manufacturers, and not just via warrants or court orders. Subaru’s policy said the company may send customer data to governments not just when legally required, but when Subaru doing so “will prevent, solve or prosecute a crime” or protect its own interests or business partners.
Toyota’s policy also says the company may share data with government or law enforcement requests, even if they’re informal.
“[Toyota] may transfer and disclose your information to other parties to comply with a legal obligation; when we believe in good faith that the law or a governmental authority requires it,” the policy reads.
Companies that operate in Tennessee, including car manufacturers, have to be compliant with the Tennessee Information Protection Act. The law went into effect July 1 and is similar to other state laws cracking down on information privacy.
Specifically, Tennessee customers have the ability to request what data companies collect, how it’s used and even request that the data gets deleted.
Tennessee Attorney General Johnathan Skrmetti is in charge of enforcing TIPA. He said learning about some data car manufacturers collect is cause for alarm.
“I’m very concerned about the idea of audio recordings because nobody thinks when they’re in their car that they’re being recorded,” Skrmetti said. “Data is being gathered that people don’t know about that’s having a big impact on their pocketbook.”
He said a big part of TIPA is encouraging companies to be transparent, even and especially when his office has to step in.
“There has to be transparency, and there has to be control by the consumers over what’s done with their data,” Skrmetti said. “If anybody’s playing games out there, we have some great lawyers who want nothing more than to go after big companies that are treating people wrong.”
Even so, Skrmetti has a fine needle to thread. He’s in charge of enforcing TIPA, but also needs to protect the state’s interest in being business-friendly.
“The Tennessee Information Protection Act in particular is designed to be business friendly while protecting consumers,” he said.
Maurice Stucke is a law professor at the University of Tennessee. He’s served as an advisor for the FTC, prosecuted for the U.S. Justice Department and written books on data privacy. He said TIPA is a good start, but there’s still a long way to go.
“If nothing else, it’s going to help consumers understand their privacy,” Stucke said. “The problem is that there are gaps in the statute and they’re not going to necessarily provide you the privacy that you might think you would have.”
One concern for Stucke is a loophole that just requires one set of human eyes on your data.
“In Tennessee, one of the loopholes is that if it’s solely automated, then the protections apply. But if one human is involved, then it doesn’t apply,” Stucke said. “And that doesn’t really make much sense.”
Cole Johnson drives Tennessee roads just like anyone else. She said she’d like to see the data privacy situation change drastically.
“I would like that all of this information isn’t sold, isn’t monetized,” she said. “I just think that none of it should be used at all.”
Specifically, she said the idea of a car manufacturer sharing data with governments gives her pause.
“With everything that’s going on, it makes me nervous,” she said. “I don’t really want anybody spying on me.”
Skrmetti himself said that, if needed, Tennessee lawmakers would go back to the drawing board on TIPA and add more protections.
“If there are problems with how the TIPA works in practice, I don’t think they will hesitate to go back and make sure that they have an effective law,” Skrmetti said.
We reached out to some of the top car manufacturers in the U.S. Most provided statements or answered questions about how they collect data and what it’s used for.
We’ve collected their responses below:
What data do you all collect from drivers / consumers who use your vehicles? Ex: geolocation, audio recording, etc.
At Ford, customers have a choice as to whether or not they wish to share connected vehicle data with us. Using in-vehicle settings, customers may turn vehicle connectivity off entirely (resulting in a disconnection from the cellular network) and may use granular settings that control sharing vehicle data (e.g., odometer, oil level), driving data (e.g., braking), and/or location data with Ford.
It might be helpful to understand more about how we use vehicle data. Ford uses connected vehicle data to make our vehicles more enjoyable to drive and own, including by providing and improving services that are requested by our customers. For example, connected vehicle data is used to provide navigation services, vehicle health alerts and reports, connected radio, and connected weather. In electric vehicles (EVs), connected vehicle data may also power EV-specific actions such as locating nearby Blue Oval electric-vehicle charging stations, paying for charging, and EV charge programming.
We also use connected vehicle data to improve vehicle quality, make our vehicles safer, and minimize environmental impact. For example, we use connected vehicle data to develop and improve vehicle features such as autonomous vehicle technology, and to more quickly identify and remedy potential vehicle performance issues. Connected vehicle data may also be used in recall-related investigations. As the National Highway Traffic Safety Administration recently concluded in a June 2023 letter to automakers, connected vehicle data can be “an important source of information for safety oversight and field performance monitoring by the authorities and vehicle manufacturers”.
For more information, we recommend that our customers read our Connected Vehicle Privacy Notice, available at https://www.ford.com/help/privacy/
Who, if anyone, do you all sell that data to? If yes, can you be specific on which data brokers / third parties you share it with?
Ford does not sell any connected vehicle data to data brokers, period.
Does that include insurance companies? If so, who?
Ford does not provide data to usage-based insurance programs. Some insurance providers use mobile phone data to extrapolate driving behavior, so some Ford drivers may choose to participate in usage-based programs via that method.
Does your policy include providing data to law enforcement or governments? Does that include non-formal requests?
We are committed to supporting the safety of the communities we serve while protecting individual privacy. We do this by requiring valid legal process or vehicle owner consent before sharing vehicle data with law enforcement.
What data do you all collect from drivers / consumers who use your vehicles? Ex: geolocation, audio recording, etc.
The types of data we collect from consumers can vary depending on the nature of their relationship with Nissan; for example, if they are an owner, prospective owner, etc. We disclose the types of data we collect in Nissan’s Privacy Notice.
A few categories of information we commonly collect:
Who, if anyone, do you all sell that data to? If yes, can you be specific on which data brokers / third parties you share it with? Does that include insurance companies? If so, who?
As explained in Nissan’s Privacy Notice, Nissan generally does not sell consumer data to external third parties. For example, Nissan does not currently sell or share driving activity or driver location data or disclose this vehicle data for any targeted marketing purposes. We will only share this information with a consumer’s affirmative and informed consent unless we are legally required to do so (see below). Nissan does not sell any driving activity data to insurance companies for programs that might directly impact a consumer’s premiums unless they have consented or asked an insurance company to retrieve this information, nor do we sell personal data to marketing companies to send advertising for products or services that are not related to Nissan. And Nissan never sells sensitive personal data (as that term is defined in state privacy laws) to third parties, as we outline in the Privacy Notice.
Nonetheless, there are certain types of data disclosures that can be considered a “sale” under certain state laws, such as transferring data from a customer who has expressed interest in a Nissan vehicle to a local dealer for follow up. These instances are specifically spelled out under the heading “Categories of Information We Collect, Use and Disclose (Including Use or Disclosure for Targeted Advertising)” in our Privacy Notice.
Does your policy include providing data to law enforcement or governments? Does that include non-formal requests?
Like all companies, Nissan has a legal obligation to share some Personal Data with government entities in certain situations. For example, we are required to share Personal Data such as name and social security number to the IRS when we pay someone (such as a sweepstakes or contest winner). We are also required to provide certain limited Personal Data according to the terms of a subpoena, court order, search warrant or if requested by a legal organization in case of a lawsuit. We only supply such information with appropriate documentation, and we provide the minimum amount required to protect our legal status or to meet our compliance or legal requirements. This is also outlined in the Privacy Notice.
Read more on https://www.wvlt.tv
