Everything you need to know about what your car knows about you

This article has been updated from a previous version.

“Modern cars are more than simply vehicles,” federal privacy commissioner Daniel Therrien told the Parliament of Canada in May 2018. “They have become smartphones on wheels.”

Smartphones, however, have raised well-known privacy concerns about the data they collect on their owners for as long as they have existed. Cars, meanwhile, have only recently gained the technological capacity for spying.

“Most of the data flows in the connected car are very complex and not transparent,” Therrien told lawmakers at the time. “Individuals are accustomed to simply getting in a car and driving, and may have little awareness about how the data captured in a connected car may be used in the background, let alone the implications of those uses.”

“This information,” Therrien explained, “is not strictly about the car; it can be associated with the car’s driver and occupants and used to expose patterns or make inferences about those people for a number of purposes not all related to the functioning of the vehicle or safe transportation.”

Connected vehicles “collect information about driver habits and behaviour, biometric and health data, location data, personal contacts, schedules, communications and entertainment content choices,” he said.

That was nearly four years ago, and the amount of data the average car collects on its occupants has been growing rapidly ever since. Below are just a couple of examples of personal details your car knows about you that you might not even know about yourself:

• Your weight: Ever wonder how your car knows whether to disable the airbags? That is due to weight sensors in both front seats. For years they only measured if there was enough weight on the seat to justify enabling the airbag. But as those sensors have gotten more refined, they have started to track how drivers’ weight changes (either up or down, in this writer’s case, usually up) over the car’s lifespan.
• Your mental health: “With [artificial intelligence] analysis of your driving behaviour, it can determine [your] level of stress and possibly if you take anti-depressants,” says Jean-François Champagne, president of the Automotive Industries Association of Canada (AIA). “Your driving behaviour is going to change as a result of those variables, and these vehicles can track all of those finite details now.”

Who owns that data and why it could be costing you money

According to Teresa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa, the default across most of North America right now is that whoever collects the data owns the data. That means Ford owns the data collected from Ford drivers, Honda owns the data collected from Honda drivers, and so on.

Aside from the privacy concerns over what carmakers might use that data for (such as sharing it with third parties like satellite radio providers, as most carmakers already do), there is a strong case that the existing state of affairs costs consumers money.

Aftermarket service providers, like your local mechanic, “want to be able to provide maintenance or parts for your car, but they need to know certain information about your car to provide those things,” Dr. Scassa says. “But the way things are structured right now, they can only get the data they need to perform those services from the [carmaker], and the [carmaker] is going to charge them a premium for access to that data.

“You, the consumer, who has been generating that data, are going to pay a higher price for that service as a result because the aftermarket service provider needs to recoup those extra costs, even though, in theory, it is actually your data.”

Champagne, whose organization represents more than 4,000 automotive maintenance and repair locations across Canada, warns that “it is becoming increasingly difficult to access critical information in a vehicle because the carmakers essentially control that data.

“They control how, where and by whom that data is accessed,” he says.

Even a relatively simple operation, such as installing new brakes, requires access to a vehicle’s onboard computer, as does anything related to its collision-avoidance technologies. Champagne said the situation has already reached a point where, for example, any Honda or Toyota vehicles with transmission issues in Canada can only be repaired by the carmakers themselves.

Part of the problem, according to Dr. Scassa, has to do with consent. When buying a new car, drivers don’t exactly have the option to say no.

“The more cars become connected and more integrated, the more there will be a de facto assumption that you are going to provide that data,” she says. “It will simply be a condition of buying the car or getting insurance that a customer be required to allow access to that data.”

Some data-focused insurance products, such as usage-based policies or apps that monitor driving habits in exchange for lower rates, have grown increasingly popular. However, the insurance industry has been slow to adopt the latest data analysis tools, leaving carmakers in the proverbial driver’s seat.

“The idea for the carmakers is to be able to control the entire life cycle of the vehicle,” Champagne says. “So we foresee a time when the vehicle will come with insurance from the automaker built into it, which will ensure [carmakers] will be able to control the whole repair process for the vehicle as well [so] they can determine who is going to be able to access their parts, when and at what price.”

Efforts underway to give you more control over your data (and save you money)

As of April 2022, the AIA had garnered nearly 44,000 signatures for a petition urging the federal government to address the status quo, which Champagne says is focused on “the impact this is already having on consumer choice, the cost of repair and the cost of transportation in general.”

Ottawa is considering Bill C-11, which would update the Consumer Privacy Protection Act to pave the way for drivers to have more control over their data. The AIA would like to see something similar to the Right to Repair legislation that has been on the books in Massachusetts since 2012, which requires consumers to be provided access to their onboard telematics data using a standardized open platform that can be shared with their repair technician of choice.

Others believe Canada should follow in the European Union’s footsteps, which implemented its General Data Protection Regulation (GDPR) in 2018 expressly to grant individuals broad legal rights to their data, regardless of how it was collected.

“Now we are, for the first time in Canada, starting to see the rise of this idea that maybe you could have a more consumer-centred model,” Dr. Scassa says. “Instead of consent being something you give away at the time when you sign all the car purchase paperwork and initial everything in a take-it-or-leave-it environment, consent could become something more meaningful because you get to decide who has access to your data.”

“By having that control,” Dr. Scassa says, “you’ll have companies coming to you with promotions and offers, and they would have to compete with each other more for your business.”