> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. However, if you use a wired USB connection then it does not do that (see the discussion here and elsewhere), so I exclusively use CarPlay via USB.
The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.
They are both very cagey with how they talk about this (or don't).
> The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.
Do you have evidence or a citation for this? Or is it just the sort of statement that’s made in the pretty certain expectation of upvotes on HN?
Yeah, but at least for now they don’t have the power to remotely disable my car or jack up my insurance prices and I trust Apple 1000% more than any of the other random car companies do not sell my data.
> They are both very cagey with how they talk about this (or don't).
No, not really - at least not apple. They are very clear on what CarPlay’s privacy stance is, and they’ve got privacy white papers on pretty much everything:
Excellent practical guide and pictures, if OP is around on this thread: well done! Your future self is going to appreciative too when this needs repeating at some point!
Great guide! After getting to the end, I had no idea what AirPlay was so I looked it up... bro, all this effort to avoid telemetry and you are using an iPhone XD
> Unfortunately I think it’s only a matter of time before the modem and GPS become more deeply integrated into the car (making this blog post infeasible), or cars have more drastic failure modes when the modem/GPS is removed, or anti-right-to-repair laws get passed to further clamp down on this behavior.
The 2024 Ford Maverick has a single fuse for the telematics unit that you can remove without throwing a code or an error. No idea if this remained true after the 2025-2026 refresh, but worth knowing.
> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota
What is the basis for this claim? I've never heard of this capability.
When I was a younger man, audio visual forums used to have an unfortunately sexist, but fairly good conceptual measure they called “wife acceptance factor”. It should really just be partner acceptance factor. Regardless of whom you are with, I hope they would physically intervene before letting you do this. What is the point? All of these posts feel like they miss the forest for the trees. Don’t like This Modern World? Fair enough, start by leaving your phone at home. Pay cash. And so forth. The author’s problems would be better solved by taking the bus. If you’re going to get into messing with cars, the wiring harness is not the place to start. Every trip to the dealer or any other mechanic is going to be painful right up until you finally give up and try to private sale the vehicle. At some point in that process, after you have dropped the price by over half the Kelley Blue Book value (or whatever Palantir shit replaces that) you may actually hear yourself explaining to the pleasantly smiling with a certain look in their eye non buyer about how you had to do this.
I will admit my bias. Fair play to the author for putting this all together but it reads like a very intricate aluminum foil hat.
Get a determined ex-partner who knows a lot about you and wants to harm you or kidnap your children. For most people this represents the greatest immediate risk with this kind of data.
I honestly can't either. A lot of people drive around with navigation set on their phones which also track every movement and knows your exact location and travel speed, might even know how aggressive you drive based on accelerometer data and all that info can be uploaded from navigation app like Waze which is very popular
Just a note about Toyota specifically - There are many blog posts and articles out there alleging that Toyota shares your data with insurance companies.
As I own two Toyota's I have read through these carefully and consistently the theme is that the owner was opted into this program without knowing it (likely by the sales person clicking through setup steps to enable every feature). If you are not opted in, I have seen no evidence they share driving data.
When I set up my Toyotas, the app clearly walks through the programs they have and you must click either "yes/opt in" or "no/opt out" for each program. It is not opted in by default.
Before 2018-2019, the opt-in process for data sharing was hidden on a website somewhere. Around that time, the form became part of the vehicle purchasing process.
On the 23 4Runner, telemetry is enabled by default. You get warning stickers but other than that, it's just on. No app, no other indicator. Had the dealer removed that one sticker, there would be no obvious indicator
A lot of engineers view the touchscreen head unit to be the central nerve system of the car, when in reality it's just a peripheral. It's an accessory. It's like those gimmick CPU coolers with a watch sized display. They use different models of that screen for different trims of same cars. This article in fact discuss removal of the DCM unit, not removal of the touchscreen; the touchscreen is still 100% functional. Because the entire screen is just an accessory.
What that means is, those data collections don't necessarily go through that display thing, therefore collections consent/disable screen just might not be there. Maybe it's in the paper contracts or maybe they think cars aren't people, but my point is, a car is not built around the display, and there is no guarantee that the tracking code is on that part of the car.
When I bought my 2024 Lexus, there was a sticker on the headlamp saying to push the support call button to talk to a rep if I don’t want any vehicle data collected . So I did and the rep told me they can disable it but it will also disable the SOS/911 calls and crash report if I do that. Choosing my own battles, I begrudgingly told them to leave it enabled.
If you are wary of all the smart features in your next car purchase, consider buying a bicycle. We do not have to entertain the creeping invasion of our privacy
How good a position can you get from GPS today in receive only mode?
You can download and store Open Street Map for individual states. Map data doesn't have to come in over the air. That's not the problem. It's enhancing GPS with cell phone tower data that's the problem. That requires a cell connection.
Resolution of less than 1 meter is normal with a decent view of the sky and a lack of interference. GPS itself is always receive-only on our end as consumers.
What problem are we trying to solve here? At this point in time, guided navigation with completely offline maps and GPS has already been a no-brainer off-the-shelf thing for decades.
We need more posts like this. I'd love a follow-up where instead of removing it injects fake data to the system. I am tired of passively being digitally assaulted. If they are going to do this to me without my knowing consent I want to fight back.
Just be aware, this is something that will be noticed. I've been building analytics systems for a while now and have had people do this. Usually it gets picked up by the anomaly detection system or as an alert in the ETL pipeline when we try to transform it.
Personally, I just plop it into a "dead letter office" table, then verify it's not malicious. But it's possible other companies would handle this differently.
> Strong Federal privacy laws would make posts like this unnecessary, that’s the world I’d rather live in.
yes. there ought to be a right to reasonable expectation of behavioral privacy where if it's not obvious and intrinsic to function that behavior is being recorded then it must be consented with functional opt-out.
gps tracking to the manufacturer of a car seems egregious. i wonder if it runs afoul of anti-stalking laws.
Modern cars are horrible. I recently discovered that all new cars sold in the EU constantly beep at you for supposedly speeding, even though the system doesn’t work well, and it has to be turned off every time you start the car.
They beep when you go above the speed limit, and only for a couple seconds. If they do that 'constantly' the problem is in the driver's seat...
It takes two seconds to turn off in my car (though by law it has to reset on every drive), but I never bother. In situations where it's "ok" to drive a little over the limit, it's a small price to pay and a gentle reminder.
130 comments
[ 2.4 ms ] story [ 93.6 ms ] threadAfaik phones do not share their internet blindly to Bluetooth devices.
The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.
They are both very cagey with how they talk about this (or don't).
Do you have evidence or a citation for this? Or is it just the sort of statement that’s made in the pretty certain expectation of upvotes on HN?
No, not really - at least not apple. They are very clear on what CarPlay’s privacy stance is, and they’ve got privacy white papers on pretty much everything:
Eg. https://www.apple.com/privacy/docs/Location_Services_White_P...
Again, at least on the apple front this comes off as a ton of “stated without evidence “
I have done extensive research into this, and Apple provide basically zero information about what information carplay collects about your vehicle.
Location data isn't the only kind of data that your car feeds to your device through the carplay connection.
Guaranteed
https://www.mavericktruckclub.com/forum/threads/telematics-f...
You have the full right to view and ask for deletion.
What is the basis for this claim? I've never heard of this capability.
When I was a younger man, audio visual forums used to have an unfortunately sexist, but fairly good conceptual measure they called “wife acceptance factor”. It should really just be partner acceptance factor. Regardless of whom you are with, I hope they would physically intervene before letting you do this. What is the point? All of these posts feel like they miss the forest for the trees. Don’t like This Modern World? Fair enough, start by leaving your phone at home. Pay cash. And so forth. The author’s problems would be better solved by taking the bus. If you’re going to get into messing with cars, the wiring harness is not the place to start. Every trip to the dealer or any other mechanic is going to be painful right up until you finally give up and try to private sale the vehicle. At some point in that process, after you have dropped the price by over half the Kelley Blue Book value (or whatever Palantir shit replaces that) you may actually hear yourself explaining to the pleasantly smiling with a certain look in their eye non buyer about how you had to do this.
I will admit my bias. Fair play to the author for putting this all together but it reads like a very intricate aluminum foil hat.
As I own two Toyota's I have read through these carefully and consistently the theme is that the owner was opted into this program without knowing it (likely by the sales person clicking through setup steps to enable every feature). If you are not opted in, I have seen no evidence they share driving data.
When I set up my Toyotas, the app clearly walks through the programs they have and you must click either "yes/opt in" or "no/opt out" for each program. It is not opted in by default.
Before 2018-2019, the opt-in process for data sharing was hidden on a website somewhere. Around that time, the form became part of the vehicle purchasing process.
What that means is, those data collections don't necessarily go through that display thing, therefore collections consent/disable screen just might not be there. Maybe it's in the paper contracts or maybe they think cars aren't people, but my point is, a car is not built around the display, and there is no guarantee that the tracking code is on that part of the car.
You can download and store Open Street Map for individual states. Map data doesn't have to come in over the air. That's not the problem. It's enhancing GPS with cell phone tower data that's the problem. That requires a cell connection.
What problem are we trying to solve here? At this point in time, guided navigation with completely offline maps and GPS has already been a no-brainer off-the-shelf thing for decades.
Personally, I just plop it into a "dead letter office" table, then verify it's not malicious. But it's possible other companies would handle this differently.
yes. there ought to be a right to reasonable expectation of behavioral privacy where if it's not obvious and intrinsic to function that behavior is being recorded then it must be consented with functional opt-out.
gps tracking to the manufacturer of a car seems egregious. i wonder if it runs afoul of anti-stalking laws.
It takes two seconds to turn off in my car (though by law it has to reset on every drive), but I never bother. In situations where it's "ok" to drive a little over the limit, it's a small price to pay and a gentle reminder.