Is your car tracking and spy on you? That’s the question Choice has asked in a special investigation into Australia’s 10 most popular car brands – and Kia, Hyundai and Tesla were found to be the worst offenders.
In Choice’s investigation they analysed the privacy policies of these car companies to work out the data collected from drivers, what they did with it and whether the customers had a choice to opt in or out of this data collection.
Today’s cars have truly embraced digital connectivity and the fact their vehicle can collect your data would be surprising to many drivers.
Choice looked at the privacy policies of Tesla, Mazda, Kia, Mitsubishi, Ford, Isuzu Ute, Hyundai, MG, Toyota and Subaru.
It found that seven of the most popular cars brands collect some form of data through a connected service and relay that data back to the company.
Three companies – Mitsubishi, Subaru and Isuzu Ute – don’t have current connected services enabled and therefore were not collecting data.
“We discovered that Kia, Hyundai and Tesla were the worst offenders when it came to protecting the privacy of their customers,” says Rafi Alam, Senior Campaigns and Policy Advisor at Choice.
“Kia and Hyundai both collect and share voice recognition data with third parties, along with other information.
“Tesla takes it one step further, collecting ‘short video clips and images’ captured from the camera inside the vehicle, and shares some data with third parties.
“The only three brands that don’t collect or share driver data in Australia are Mitsubishi, Subaru and Isuzu Ute.
“The fact that these three are outnumbered by the seven other brands we looked at is highly concerning.”
The biggest car brand in Australia, Toyota, was found to collect vehicle location data and “Drive Pulse” data which looks at a driver’s acceleration, cornering and breaking on each trip which is then shared with Toyota, “related companies” and other third party providers.
Ford also admitted to collecting and sharing driver data with third party companies, but Choice was told it doesn’t sell the data to brokers.
MG also collects and shares data with service providers to provide functionality but denies its shares with third parties.
Mazda admitted to collecting voice consumption data before sharing it with service providers and undisclosed third parties, but Choice says the company did not respond to their requests for clarification.
But tracking and sharing driver data is only part of the picture.
Some car companies also gather voice recognition data and facial recognition and shares that information with third parties.
These types of data are considered biometric information and classed as sensitive data under privacy laws and can only be shared with the customer’s consent.
Kia was found to be collecting data from the use of voice recognition technology as a way it could improve AI-powered interactions.
Hyundai, which has the same parent company as Kia, told a similar story.
Leading EV manufacturer Tesla says it gathers voice command data along with short video clips and images captured from the camera onboard the vehicle.
The company also shares this information with third parties but insists the data is subject to “privacy preserving techniques” that are “not linked to your identity or account”.
The companies that are collecting data who responded to Choice said that customers do have the ability to opt out.
But it was discovered drivers were opted in automatically when they buy their vehicle or download the car’s app without even knowing it’s happening.
“The results of our investigation are a timely reminder that Australia’s privacy laws are woefully out of date, and certainly not fit for purpose in a market where cars are collecting and sharing personal information en masse,” says Alam.
“Under the current laws, businesses are able to write their own rules through their privacy policies.
“At a minimum, the federal government should implement a fair-and-reasonable-use test, which would legally require businesses to collect and use data in line with consumer expectations.”
