Over half of drivers of connected cars are concerned about data privacy

As our roads become increasingly digitized, modern cars are no longer just modes of transportation; they’re data-rich ecosystems on wheels.

Connected vehicles gather a wealth of information, from driving behavior to personal preferences, and transmit it across networks. But what happens to this data? Who owns it, and how is it used?

A recent survey commissioned by RATESDOTCA found that 57% of Canadian drivers with connected cars are concerned about the privacy of the data collected by their vehicles. As it turns out, their concerns may be well founded.

What is a connected car?

Connected vehicles, or smart cars, utilize various wireless technologies to communicate with their environment.

While the specific technology may vary among vehicles, most connected cars are equipped with a cellular modem, allowing it to connect to the internet, social media, and entertainment systems that enable drivers to interact with the environment and other devices.

Beyond direct inputs (like infotainment systems), cars gather data from cameras, microphones, and sensors.

Here’s a snapshot of their capabilities:

Data generation

Connected vehicles continuously collect data during journeys. This includes speed, acceleration, braking patterns, driver destinations, infotainment settings, and even external footage (from dash cams and lights).

Telematics and usage-based insurance (UBI)

Telematics systems track driving behavior, rewarding safe practices. UBI, also known as pay-as-you-drive insurance, calculates premiums based on actual driving habits.

Data transmission

Cars wirelessly exchange information with manufacturers, service providers, infrastructure operators, and other vehicles. This connectivity enhances safety, efficiency, and convenience.

Dedicated short-range communication (DSRC)

DSRC enables vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication. Think of it as cars having a secret language—they quietly exchange critical information across long distances. It's the car’s sixth sense that prevents accidents by sharing real-time data.

For example, when your car senses danger (like another car suddenly braking), it sends a warning to nearby vehicles via DSRC.

Related: Can a vehicle’s safety features get you cheaper car insurance?

43% of Canadian drivers have a vehicle that connects to the internet, a smartphone and uses apps

According to the survey, more people report having a vehicle that connects to the internet than don't. 43% of drivers have a car that connects to the internet, a smartphone and/or uses apps whereas, 38% don’t.

This sentiment is reflected by consulting firm, McKinsey’s forecasts that predict by 2030, approximately 60% to 70% of new vehicles sold in North America and Europe will achieve a level known as Connected Car Customer Experience (C3X) Level 3 or higher. At this level, cars have advanced features like real-time navigation, remote diagnostics, and personalized services.

Considering most of these modern vehicles with smarter technologies are accompanied by higher price tags - 50% of those with connected cars earn between $60,000 and $100,000 annually, and 55% earn over $100,000.

For those without connected cars, 43% earn less than $60,000.

What type of data is being mined and from whom?

The data generated by cars will be worth as much as $750 billion by 2030, according to McKinsey. With such a high valuation, consumers should consider who should control that data, and how it will be used.

Based on Leger survey results, 34% of Canadian drivers consented to allow for data to be collected through their connected cars. The people most likely to allow their data to be connected were men (40%), urban-dwellers (40%), and those who identified as Black, Indigenous and/or Person of Color (BIPoC).

On the flip side, 57% of participants with a connected car refused to hand over access to their data.

“Instead of thinking of your car as simply a vehicle of transportation, it’s important to see your car as a series of computers that make the vehicle work. These computers manage functions, including navigation, entertainment, safety features, and communication that then send that data off in more or less secure ways,” says Natasha Tusikov, a professor in the criminology program at York University. Her research examines the intersection among law, crime, technology, and regulation.

Thanks to technology, your car knows you better. But it’s not the only one

According to a 2023 report by Mozilla, major global car brands, including BMW, Ford, Toyota, Tesla, Kia, and Subaru collect highly personal data.

This data encompasses a wide range of aspects, such as details about your driving habits, immigration status, race, facial expressions, weight, health, genetic information, and even sexual activity.

The data is collected through various channels, including sensors, microphones, cameras, and the phones or devices that drivers connect to their cars. Disturbingly, these brands can share or sell this sensitive data to third parties.

“The data ecosystem within cars is quite intricate. Where your data ends up depends on which part of the car collects it. For instance, if it’s a car component, the data might go to the original manufacturer. However, if it’s software-related, it could be sent to the software company, which may then sell the data to third parties,” says Tusikov.

She continues to explain that understanding this ecosystem can be challenging for the average person without access to legal contracts. While information about your vehicle’s mapping or infotainment system may be available if requested, it’s not always guaranteed that the exact purposes will be clearly outlined

For instance, the BMW i5 M60 xDrive Sedan and it comes equipped with a digital key, virtual driving assistants, maps with automatic updates, Apple CarPlay and Android Auto, a personal assistant, a mobile app, remote software upgrades using your car’s SIM card, and many more technologies – all of which collect data.

And while smart cars cater to higher incomes and are often considered a luxury — the BMW is priced at $95,000 — all that comfort comes with certain risks. These technologies can be distracting and overwhelming, particularly for older generations who experienced life before the technology boom. Interestingly, this is also reflected among the drivers surveyed: 46% of those with connected cars are younger Canadians under the age of 55.

Data and privacy issues

When someone consents to a company monitoring their driving, it’s known as usage-based insurance – which we mentioned earlier. However, the rise of internet-connected cars has led to data sharing without Canadian drivers’ awareness. This happens when you install or update an app via your smartphone, which is connected to your car. By consenting to the app’s terms and agreements, you inadvertently share data.

Among those with a connected vehicle, 57% of those surveyed are concerned about the privacy of the data collected on their driving habits. Amongst which, 23% are ‘very concerned’, and 34% are ‘somewhat concerned’.

Similar to the survey results mentioned earlier, it’s clear that male drivers and individuals from BIPoC communities are more likely to consent to data collection. Interestingly, these same groups also express greater concern about the fate of their data. Specifically, 63% of concerned respondents are male, compared to 52% of females, and a significant 68% are from BIPoC backgrounds.

Service providers often ask customers to consent to using their personal data. But the consent isn’t limited to service delivery—it extends to marketing, product development, and other “business purposes.”

"The average Canadian is uncertain about the data that companies extract, repurpose, sell, or exploit while we’re in our cars. Legal contracts are often not visible to us, and companies tend to provide only minimal security, marketing, or legal disclosures,” says Tusikov.

This practice contradicts Canadian laws, which mandate clear and informed consent specifically for secondary purposes like marketing. However, not all drivers are equally bothered. 38% of drivers surveyed are either not very concerned or unconcerned entirely.

Some services, such as Toyota’s ‘Insure Connect,’ have straightforward names, others — like Honda — embed details about data sharing within their privacy policies. For instance, there have been cases where after enabling Honda’s “Driver Feedback” feature, information was shared with a data broker, who subsequently shared it with insurance companies.

Existing regulation surrounding connected car technology data

Generally, data privacy in Canada is governed under both Personal Information Protection and Electronic Documents Act (PIPEDA) and Canadian privacy law.

The regulation of data from connected and automated vehicle (CAV) technology remains relatively lax in the country. In response, the government reintroduced Bill C-27: Digital Charter Implementation Act, 2022 to replace the current federal PIPEDA which has regulated the collection, use and disclosure of personal information since 2001.

As the connected car field evolves, unresolved issues persist.

“Your car. Your data. Your choice.” passes 44,000 signatures in Canada

The Automotive Industries Association of Canada (AIA) has formally joined the “Your Car. Your Data. Your Choice.” aftermarket initiative, introducing this consumer awareness program to Canada. The campaign, led by the Auto Care Association and the Automotive Aftermarket Suppliers Association (AASA), aims to raise awareness about the importance of consumers having control over the extensive data collected by their vehicles.

Additionally, this initiative serves as a petition to the Minister of Innovation, Science and Industry, emphasizing the need for greater consumer control over data privacy.

According to Tusikov, the government should prohibit private sector actors from collecting certain types of sensitive information, such as biometrics. Currently, we lack the necessary safeguards to handle this data responsibly.

“Consumer pressure plays a crucial role in influencing our elected officials. While there may be benefits to innovative data usage, individuals should have the right to consent and opt out if they feel uncomfortable.”

How your insurance company uses your data to handle claims

When a collision involving a connected vehicle occurs, crucial data related to the vehicle is stored in a type of “black box” within the car itself. This data includes information about road conditions, speed, braking patterns, and other relevant parameters.

Insurers can face challenges in accessing this information (even with the driver’s consent) – especially if the ownership of this data is given to the car manufacturer – which is an ongoing issue outlined in the Right to Repair advocacy, where the automotive aftermarket and original equipment manufacturers (OEMs) are at odds over car data access.

Manufacturers control access to the black box data, and they could deny insurance companies the ability to review it, citing ownership rights.

But insurers still have ways to access to your personal information - while technically under PIPEDA, insurance companies must first obtain consent from you before collection any personal information, they also claim that your personal information will be made summarized or rendered anonymous when using for other purposes as outlined by the Insurance Bureau of Canada (IBC).

Tusikov highlights a common misconception: Companies often claim that they anonymize data, making it impossible to re-identify individuals. However, she says that this assertion doesn’t hold up in practice.

“Insurance companies receive data about people’s driving habits and traffic patterns. While the data is initially anonymized, insurance companies use it to gain insights into traffic behavior and adjust premium pricing," she says. "The assumption is that individual drivers cannot be identified from this aggregated data, but this is not always true.”

Imagine you own a Tesla in a small town. In such cases, the car and its owner become highly identifiable due to the rarity of Teslas in that area.

The point she makes is that companies claim to remove identifiable traits from data entries, but this process isn’t foolproof. The risk of re-identification remains.

11% of drivers are okay with sharing their data if it means cheaper insurance premiums

During the COVID-19 pandemic, usage-based auto insurance (UBI) gained traction. This approach involves paying insurance premiums based on how much you drive using telematics. Telematics also monitors your behavior while driving by tracking factors like speeding, abrupt braking, acceleration, and phone use.

By demonstrating safe driving habits, individuals can potentially save up to 25% or even 70%. Sounds like a great deal. And it was, until recently.

Read more: As insurance premiums rise, quotes for usage-based auto insurance increase by nearly 20%

With more detailed data comes higher premiums

Insurers analyze telematics data to assess a driver’s risk profile. As of November 2020, Ontario drivers participating in UBI programs started facing an insurance surcharge when they exhibited high-risk driving habits.

Add drivers in Quebec and Alberta to that list.

Previously, sharing data didn’t penalize drivers; even if you had a few bad driving habits but no convictions or accidents, premium remained stable. However, now your driving data allows insurers to raise premiums.

While UBI aims to reward safe driving, it might inadvertently penalize certain groups. For example, if you drive during late hours due to work or other reasons, your premium could increase even if you’re a safe driver.

“Our legal protections aren't where they should be in Canada,” says Tusikov.

“Privacy protections assume that individuals enter relationships with businesses fully informed, but this isn’t the reality. Most companies offer click-and-consent options, and if you dig deeper, you’ll find lists of companies—say, 54 for marketing and research purposes. However, this information is meaningless to the average person.”

She continues, “are we really expected to research all 54 companies, plus 64 security companies, and understand the legal implications? The truth is, most people lack the time, resources, and legal expertise to do so."

Read more: What is pay-as-you-go car insurance?

As technology continues to advance, striking the right balance between data privacy and seamless user experiences becomes increasingly critical. The automotive industry continues to face ongoing challenges in this arena, as it seeks innovative solutions that empower consumers while preserving the convenience and efficiency of connected vehicles.