Do they do the same spying on the models/units produced for sale in EU? It’s not actually a necessary part of the operation of the device, so it makes sense they’d be able to sell them without it.
HN on average is a little behind on the general EU "privacy" stance (though I saw some recent topic about that here). EU was about privacy, a few decades ago. Nowadays it did a complete U-turn and legislates mandatory anti-privacy union-wide laws every year.
- Chat Control law, now all messaging must be intercepted and monitored.
- eIDAS law, mandating that web-browser vendors must now accept state issued root certificates, so that states can selectively and without any legal procedure deploy MITM attacks at will.
- ADDW law, mandating that all new cars must a permanent mandatory camera and microphone surveillance module inside a car, which can't be disabled by law (bye-bye insurance if you will). There also other fun things in it like mandatory autobraking, mandatory auto lane-assist etc.
- ProtectEU laws, demanding backdoors to emails and such (maybe it's the same as Chat Control, not sure).
- AI Act legalizes AI surveillance over CCTV recordings without any judicial approval.
- European Media Freedom (duh) Act legalizes deployment of shit like Pegasus against journalists.
I'm pretty sure I'm missing a lot here too. You get the picture. EU is getting fast track into Stazi 2.0, everyone is fine with it, "because children" /s
There is no EU law that mandates "all messaging must be intercepted and monitored."
There is no EU law mandating permanent, non-disableable cameras and microphones in cars.
ProtectEU is not a law, not related to email and does not demand any "backdoors."
The AI Act bans real-time facial/biometric recognition in public places... which is a good thing. It does not "legalize AI surveillance"... quite the opposite.
EMFA does not authorize the deployment of spyware and they have publicly condemned the use of Pegasus specifically.
There is always a citizen who honestly thinks that emperor is good and loves the citizens. The reality is that emperor loves the citizens that love the emperor and will do everything to find and destroy the citizens that don’t love the emperor. History books are full of such examples.
Right now I am repairing old car that does not track me, does not film me and doesn’t try to drive me. It’s a such a great joy to drive it without stupid beeping and automatic wheel movements. Especially without suicidal steering in construction sites when the modern system fails.
Chat Control - a) it is a law, mandatory in whole EU (because it is a "EU Regulation", and that is a law); b) I was indeed to broad and made a mistake, for now only not E2EE messages must be intercepted and monitored. E2EE is on a the chopping block in Chat Control 2.0 which is being drafted, in progress.
Advanced Driver Distraction Warning (ADDW) - a) it is EU Regulation and so it is a law; b) ADDW mandates a non-disableable surveillance camera (not sure about microphone) inside a car.
ProtectEU is indeed Chat Control plus extra, so here I was incorrect. Encrypted emails are temporarily safe, until Chat Control 2.0 is passed. And given how they bruteforced CC 1.0 in multiple blatant retries, it will eventually pass.
Regarding EU AI Act you are replying to something I didn't write. Sure it doesn't allow real-time surveillance. I wrote that it does allow surveillance over the recorded materials. This technicality allows passing all video through storage, then monitor suspects via AI programs all without judicial approvals.
And finally EMFA does authorize deployment of the spyware against journalists in cases of investigating a crime carrying 3= years penalty. Do I need to spell out how laughable that is? Practically any national security crime carry similar or heavier penalties and govt. can start a very broad and arbitrary investigation for any reason. This means that the matter of starting surveillance is a small technicality really with zero oversight.
ChatControl 2.0 is exactly "all messaging must be intercepted and monitored" ...
Some of it probably is a slippery slope argument however that slippery slope has materialized already in other areas ... And security plays a role here as well. Maybe the camera/software/system is mandated not to identify driver (as is written in ADDS "spec") but atrocious security the modern car has would probably allow for that somehow...
You can invoke CCPA (if applicable) and directly ask a covered business or registered data broker for an exact output of your existing information on their systems. This is honestly rare and most companies will find ways to deny you - asking for various documents to prove your identity and hoping you quit responding.
If you are a CA resident you can also get on the state's DROP platform to request that all registered data brokers delete your data, but it's only for deletion and not the other 4 types of data requests allowed under the CCPA (right to know, right to collect, right to opt out, and right to limit use).
I really wanted a modern car because of the fancy automation stuff, I thought.
But it never is economical or more environmental friendly.
Whatever I saved on my old car compared to a newer one will never be less than the theoretical fuel savings on a newer car. Repair costs will never be as much (assuming you buy a popular repair friendly car). And nothing new needs to be built for me either.
Talking as an eastern european: unless you live in a sunshine place (~Mediterranean) most of the 90s car already eaten by the rust + the salt used for defrosting on roads in the winter.
Sure _everything can be fixed_ but then your car becomes a hobby and might not everyone has an attitude and time for that.
> Talking as an eastern european: unless you live in a sunshine place (~Mediterranean) most of the 90s car already eaten by the rust + the salt used for defrosting on roads in the winter.
You can still find good examples in the UK where we have salted roads. I've paid for mine to be dinitroled. Pot holes etc are a problem here and they will affect newer vehicles too and used to go through a tyre a winter.
My wife's Ioniq 5 was hit on the bumper while it was parked. Took weeks for all parts to get to the dealer and cost thousands of dollars because sensors etc. if someone hit my 1981 Volvo 240 the same way I'm not even sure it would cause any noticable damage.
The 240 is built like a brick (both in terms of strength and looks). My dad had one when I was much younger, then he sold it for a 740. A few months after the sales, police knocked on his door and asked him a lot of questions. It turned out the purchaser had used the car in a ram-raid on a shop.
Today’s cars are safer because of the crumple zones. We romanticize the older cars but their rigidity also caused impact force to be absorbed by occupants.
Someone forgot to set the brake in their car, rolled into the back of my dads 70ish pickup. It rolled the width of a parking row, on fairly flat surface. The car had no chance obviously, but it was pretty funny seeing the damage; bumper and fender, not just a minor one you could slap out with a good fist slam either. There was zero damage to the truck
I am driving a vehicle from the 90s. Works very well. Old British Vehicle so it leaks out oil everywhere but any vehicle that is more the 20 years old will be leaking oil. Have significantly less problems than the car I sold (which was 20 years newer).
How can this be stopped, from a technical perspective? Can I wrap the comms in a Faraday cage?
Obviously it would be better to have this action be illegal. But with legal privacy protections eroding in the US and other countries, it seems prudent to have a better understanding of the systems involved in the immoral surveillance.
Vote with your dollars. I know one brand that has the most leading edge tech and does not sell my data so I bought from them. However they do use my anonymized data to train models for a future FSD capability but only because I opted in to that.
When given the choice between privacy and convenience, the great majority of consumers choose convenience over and over again.
I'm not sure what the solution is, but it's not going to be market based if you look at any recent trends. Interest in privacy is unfortunately a niche concern outside of places like HN.
Anyone who has tried to market a privacy oriented product knows what I am talking about.
Rogue employees? There is a rogue CEO who data mined the entire U.S. population with his IT devshop called DOGE and you’re still talking about Tesla and data privacy? If this wasn’t HN I would use an expletive at this point. Get lost.
“FSD?” You aren’t talking about Tesla, are you? “Vote with your dollars?” So you voted for regulatory capture, election interference, erosion of free speech (due to concentration of media power), and you’re financially supporting an openly racist, openly fascist oligarch who’s let the mask completely slip? I can’t even mention the gesture he did on the inauguration stage, because the mods tend to delete any mention of that. Galaxy brain moment. /s
The fact that you even said that with a straight face. If you buy a Tesla in >2025 you’re morally bankrupt.
Yeah… I’d rather my data get sold than support any Musk-led company.
He has caused a non-zero number of deaths from entirely preventable diseases, I would rather not mention any numbers (nor do I claim real knowledge of them) before there is public accountability. Mentioning numbers tends to put the Elon Stans into a willfully ignorant state. It’s natural for them, as they have to pretend the Emperor’s garments are astonishing 24/7.
Are you being sarcastic? Hard to tell online. I don’t know the exact numbers, like I said. I know it’s non-zero because of simple logic. That’s all I need to know to form an opinion on the guy.
Found the Musk Stan. It’s perfectly fine to be angry with a political trillionaire who did all of the aforementioned things. Keep being disappointed, that’s going to be your natural state when this dust settles.
Congrats you free speech absolutist! You got my comment flagged, but the good thing is everybody with above room temperature IQ can infer what a [flagged] comment probably said based on context :)
How much do people get paid to write lies like this? This literally comes off as an advertisement. Usually some of the paid comments on this site are coy about it. Couldn’t even put in the effort to link some corporate “we don’t sell your data” promise (that nobody except an imbecile would actually believe). I’d assume the demographics of this forum are too juicy to ignore. An abnormally high amount of disposable income and abnormally high amounts of gullible individuals.
It definitely can be stopped. For example, China sells cars internally at cheaper prices, but they are locked to prevent using them outside the country. However, there are people who can hack and unlock them allowing operating in any country. But maybe it would be illegal in the West, I don't know. Removing the modem is an easier task.
> How can this be stopped, from a technical perspective?
It can't. Not realistically.
It can be stopped by legislation. But that would require politicians who have our interests as a priority rather than the various industries. So not going to happen anytime soon.
Contrary to the HN bias, but a way to avoid this if you want to get a new car full of tech gadgets is to get one that runs on Android Automotive. The privacy policy is a normal tech company privacy policy. Other cars come with privacy notices that just say they can give your data to anybody.
Sorry, but a lot of cars, even if they run Android Automotive, maintain a separate TCU/DCM with its own cellular connection that can collect vehicle information independently of Android Automotive.
Maybe the poster is saying, "There are no consequences for anyone acting in this way here, and we seem to be slipping ever more into societal moral decay, so why shouldn't I cheat to win?"
Or: "All companies are essentially gigantic conglomerates eating each others' food by selling my own and others' data to each other, so I basically have rights to their claimed assets anyway."
Or: "No company or government respects my privacy or property rights, so why should I respect theirs?"
No, this is mostly out of activism. I'm angry that the law is there for one group while the rights of another group are completely neglected. That it gives me free content is just a nice side-effect, nothing more.
I posted a flavor of this comment on an article a few months ago, but it's relevant here:
I have a seven year old Volkswagen, not financed. I'm security conscious and made sure to disable all the data collection I could find in the companion app before removing my account, turn off remote access services, dig through the infotainment to turn off what I could, etc.
Last year I requested a Carfax on it, and one of the fields in the request was current mileage. I entered an estimate like 75000 miles. On form submission, that field failed validation with red subtext along the lines of 'this is less than the last reported mileage of 75345, reported <5 or so days prior>'. Checking my odometer and looking at my past few days' trips, that was indeed accurate.
The car hadn't been to a shop or out of my possession in weeks, so I can only assume the telemetry was still dialing home and selling to third parties despite my best efforts to disable it.
It’s not futile. Write your congressperson and state representatives. If enough people do this around the country, laws will eventually be passed to prevent it.
This is why there are
moral panics about things people feel in their guts: most people are reasonably easily unsettled and distracted by queer people, people who look different, people their people don’t trust being in charge.
It works. Most people are happier focusing and holding forth on that and repeating familiar statements than they are talking to congressional staff about policy.
Your car that you paid a lot for and you like and have positive useful experiences with every day? That’s going to be way farther down the list of things to worry about.
I would be very surprised if it was that simple - systems in modern cars are so interlinked that I would expect that pulling a fuse would cause something else to break, resulting in dash lights or broken functionality.
All it would need is a wi-fi antenna internally, and then it could connect to an open wi-fi network anywhere. And it's going to be pretty much impossible to avoid ever driving your car within range of some open network.
It would have to find an open Wi-Fi network that isn't gated behind a captive portal, which is very rare. Rare enough that most telemetry would be too stale to be useful.
While LG TVs send a lot of private data when connected to the internet, I'm not aware of any credible reports that they automatically connect to open or partner-provided wifi networks automatically.
It has not been demonstrated actively in use, only that it is possible and trivial to implement. Statement with regards to it being demonstrated retracted.
I stand by the concept that any consumer IoT device could join these networks, and the end user would never know. The only legal solution to this problem statement is to physically disable the radio on the device if assurance is desired.
Tangential, but one of the concerns I have about these 'smart' cars is they have an expiration deadline.
There's an exceedingly common type of failure I have seen myself in industrial electronics and (has happened with Tesla at least once), that some module keeps a log of some kind in a nonvolatile flash, and this flash has a limited lifecycle, which the equipment reaches at some years into its life (or earlier, if the flash came from a bad batch, or more logging happens than planned).
At this point the board usually gets bricked and replacement is very hard due to cryptographic handshakes between components.
I share the sentiment. I want a new car, but only if I can guarantee all telemetry is hard disabled. But I don’t have the kind of money to buy a new car and risk bricking it. Luckily I’m pretty handy, so I’ll have to keep my 2014< cars forcefully running as long as I can.
I have non concerns about having a built in button to phone emergency services. I don’t even mind if it auto rings in a crash. I’m even happy to provide position to the emergency service in the event of dialing them.
Manufacturers use this capacity as an excuse to push more adtech penny and dime data abuse, knowing half the world will blame the government.
Generally I read your comment that a dropped phone only hits the floor once, therefore there is only one vector and the car always overturns/flips/turns and therefore there are multiple vectors measurable in the car?
I am not convinced yet, it might be possible without GPS, at least to some degree of error (false positives and false negatives).
The info in the link requires GPS to be switched on.
hmm
Disabling the antennas is the only way to be sure. There will typically be a coax connection that you can cap with a terminator. GPS can be merged with other radios you might not want to lose but suitable splitters are available.
GPS uses a different frequency and a very weak signal. The antenna is typically separate from the others but it's very small <5 mm¹. It can be on the same board with other antennas with 3…4 cm separation between them. Also, we tested a GSM tracker and it still worked with a mismatched antenna. This was in Eastern Europe where cell tower power is quite strong. You have to completely remove the antenna and terminate its connection to be 100% sure. If you have coax cables with external antennas, you're lucky. The worst case scenario is when they're embedded in the infotainment system with amtennas and everything. This is also a cost cutting measure, so it's very likely to be used. The infotainment system is usually ideally placed under the windshield for undisturbed signal reception.
I thought most would use their “shark fin” on the roof for everything (if there is one but there usually is). Terminating on the other end somewhere with a color coded FAKRA connector.
Ford has GPS with FM on the same cable. They have splitters for this arrangement. This is why they transitioned to stubby antennas for better GPS and good enough FM.
> turn off remote access services, dig through the infotainment to turn off what I could
This is never enough. You can't trust a software switch. You need to remove the hardware capability if you want to make sure the car isn't spying on you. In the best case, the telematics box has it's own fuse, and that may be enough. In other cases, you need to find the box and unplug it. The service manual will have it's location. In some cars it's easily accessible, in others less so and you need to remove the glove box or part of the dash. Dealers will probably refuse to do it, my advice would be to DIY or find an independent mechanic who will do it.
The most reliable way to permanently silence the cellular modem is to pull the relevant fuse. In the above case, this also disables the microphone, which I think is a positive. Unplugging the DCM entirely, however, seems to disable to right speaker, which is wired through the DCM for some reason.
>Unplugging the DCM entirely, however, seems to disable to right speaker, which is wired through the DCM for some reason.
I'm cynical, but unnecessarily coupling the ability to send telemetry with some feature people definitely want seems like exactly the sort of thing that would be done intentionally.
>right speaker, which is wired through the DCM for some reason
This is to provide cell phone audio during calls – if you're already inside your dashboard to remove the DCM (modem), there is an easy pin-out to restore the right speaker's music audio (which varies across Toyota models, but usually is as simple as placing a jumper across two pins of the unplugged wiring harness.
It varies by car. For my Honda, I believe disconnecting the antenna is enough. I looked at a Toyota and the antenna is shared. To disable the phone-home you had to disconnect a box … but that’s difficult. The box is also designed to call 911 or 999 emergency services and is connected to the microphone and one of the speakers. You have to rewire those if you want to use the microphone with your cellphone or play any stereo sound. Do your research before buying or disconnecting things.
Your mileage went from VW->telematics vendor->broker->carfax, thats the chain it usually follows. The fuse stops it but the real issue is the owner is the only one without the record.
You could probably find some interesting info if you send out some privacy requests through the chain. LexisNexis and Verisk are consumer reporting agencies, so they have to provide you a disclosure on request. Start there.
Is there usually a fuse that just turns off the telemetry? I would be surprised if that is the case. I could see the design being "if you turn this fuse off to turn off telemetry, you'll also lose these functions: ..." and if they did it "right" they'd make the car non-functional.
My car is from 2011 and I do wonder if there is any telemetry in it.
Yeah an electrical fuse for telemetry seems really odd. Even without malice it would be strange if disconnecting power to some part of the computer only affected telemetry.
I could see a fuse for cellular comms, be presumably that would also disable maps, contacting emergency services in an accident, etc. which might be an acceptable tradeoff.
My Ford has a dedicated fuse for accessory packages that include the modem. Mine doesn't have any other options that share that fuse so it is functionally the telemetry fuse.
There’s probably a fuse to turn off the cellular radio that transmits the data. Whether that’s all it covers may vary from car to car. Or in some models it’s probably possible to just disconnect the radio entirely.
Just looked up my 2016 Toyota. My car has no telemetry module, and for cars that do there are companies that sell harnesses that plug into the module, terminating the antennas and/or cutting power without affecting anything else
So I first read this comment and thought is looked like AI and thought I’d give the benefit of the doubt. Then I saw this where there is no doubt: https://news.ycombinator.com/item?id=49687774
I thought, I wonder if it’s the same guy? Sure enough.
If I take your two sentence comment and remove one sentence it also is non-sensical. Stop removing context.
>Your mileage went from VW->telematics vendor->broker->carfax, thats the chain it usually follows. The fuse stops it but the real...
Prior commentary advised removing the fuse to stop the telemetry. This comment points out that the chain of information flow precludes the owner of the car.
You have to read it in context with what it is referring to, and perhaps to know a little bit about the issue. In that respect, it's like a lot of conversations around here.
I read this as:
"Removing the fuse that provides power to the telematics module can stop data collection from a vehicle, but the real issue is that the putative owner is the only one who isn't instantly privy to all of the collected data."
Carfax also can report estimated mileage, but it might have a different flag in the system that allows override.
I've been handed a Carfax on my own car that has a reported mileage much greater than the actual mileage on the car, and the car has not been out of my possession.
> Antennas or not, the dealer might just plug in and upload everything during service.
You should have an empty glovebox as well when you take it in for service if you don't trust the shop.
If you have registration / insurance paperwork, you're now on that shop's mailing list and can expect to get "$15 off your next oil change ..." flyers in the mail.
Lots of automotive OEMs want that specific kind of information for generic reasons (how many of what model made it to what mileage under what circumstances) that are entirely reasonable. Lots of them also want that info for warranty related reasons (you've hit the mileage limit and we won't do anything for you anymore). But, my state of Michigan is starting a program to evaluate replacing registration fees with mileage charges to account for the additional wear and tear on the roads from EVs that don't pay gas taxes to fund road repairs. This would require some kind of verification of mileage, which we can't currently do during emissions testing, since it doesn't exist here. Legally required data retention is becoming a bigger and bigger issue, particularly in light of the driver monitoring requirement starting in MY27 vehicles by the Bipartisan Infrastructure Act terms. That will presumably be integrated into any black box recording in a crash and probably subpoenaed in any dispute going forward.
In other news, I think I'll be taking a trip to somewhere down south to find a nice, used 1999 F350 dually with a manual transmission, since they're going to cease to exist shortly...
I know you're not the culprit, but it's annoying to see crap like this (highly invasive tracking, ostensibly for slightly more efficient tax collection), when far cheaper, better efforts (like Rhode Island's attempt to add tolls for just semis -- 98-99% of their freeway maintenance costs) are killed before they have a chance to prove themselves.
I have been thinking of upgrading from my 2003 Corolla to an electric (not Tesla). The Corolla hasn't had a single repair problem in 23 years!
My main motivation to get a better car was, DD goes to a super prestigious college and it seems degrading to put their bumper sticker on a 23 year old car! But I guess I won't get another car. Serves you right mfr mfrs!
See my other comment, but the fuse pulling stuff still works on GM EVs and disables connectivity, but the telematics unit may still be collecting offline to batch upload.
The most horrible part this crime is I read somewhere That the amount the car companies get for spying on your locations is some pathetic paltry amount like $1-$5 one time. These car companies sell you out to insurance companies and such so they can collect data and use it AGAINST you. Ghouls everywhere now.
Random Public data:
Honda sold data on roughly 97,000 cars to Verisk for $25,920—amounting to about 26 cents per car.
Hyundai sold data on about 1.7 million vehicles for roughly $1 million—about 61 cents per car
That doesn’t smell right. Why develop the telemetry and go to all of the trouble for such a paltry return? That probably wouldn’t even cover the legal consulation to cover their ass, much less go through the trouble of implementing and selling the telemetry.
It would be cheaper to do nothing if that were true.
Telemetry is used to push service, which is the big money maker for dealerships. Roadside assistance, maps subscriptions, driving data for market research.
There are less questionable things they can do with all that data: I'm sure it's really useful to figure out how electrical and mechanical faults correlate with driving conditions / weather / region etc. The result from this is just a better car in the next iteration.
Then someone offers them $1 each for a fleet of 1M cars, who is going to turn down $1M for a few TB of data?
To your second point, surely they’ve considered the hit to their relationship with their customers before selling for $1/car. Surely the trust between them and their buyers is worth far, far more than that.
Even assuming maximum greed, is every car manufacturer really so short-sighted as to break that trust for so small of a return?
I oversimplified this, and actually it's a lot closer to what happens with any digital service.
Rather than saying "give us 1$ and we'll sell you a customer's data" it was more like "provide the navigation software and we'll let you keep the data". It probably seems like an elegant solution: as long as the driver needs navigation they "pay" for it with their data. It's really no different from how gmail or facebook works.
We need to start thinking more like the average evil C-suite. We live in the golden age of fraud. Not my words. There's probably some sort of circular deal where the people that enacted this data sharing personally benefit in some massive financial way. The low financial benefit from the parent company side is probably to avoid regulatory eyeballs.
something around 50% of Uber's profits now come from their "private" owned insurance Company. That, of course, does not have to disclose how they are making money. Even though Uber is their only customer.
There is probably some sort of similar deal happening here.
> I'm security conscious and made sure to disable all the data collection I could find in the companion app before removing my account, turn off remote access services, dig through the infotainment to turn off what I could, etc.
Android Auto, Apple CarPlay, OEM mobile app...Bluetooth??
Consider the business case of leased Comcast modems broadcasting open side-channel xfinitywifi SSIDs...essentially everywhere.
In my GM car I have the wonderful opportunity to pull the OnStar fuse and disable all cellular connectivity. However, I am concerned the telematics information are stored in long term storage and if I have to reconnect the fuse, all my driving will be batch uploaded. I hope not!! And the GPS still works. Maybe I can find some dummy loads as well or the antennae.
It's still better than other modern cars though? I think.
If you are willing to lose GPS, maybe you could set the car's internal clock to the year 2000. This might fool a cursory data dump that is looking for "last three months of driving habits". Would obviously not stand up to any real scrutiny, but mostly painless.
GPS provides the time, so this probably won't work. If it ever reconnects it will just reset its clock. That's often one of the first things that any computer does after a long period of no power/connection.
> third-party partners process information about you and how you use our services, including clicks and screen recordings, using first and third-party cookies, pixels, and similar technologies
Any type of data gathering should be forbidden. The "with consent" is bullshit, as the only way to not give consent is to leave society and live in a cave. (No driving a car, no taking a flight, no reading a website, no subscribing to any service, not playing games, etc.) When there is no real choice there is no consent either.
Corporations have profiles on citizens that makes the Gestapo or the KGB seem uninformed in comparison. There is no freedom when the people in power know everything about you.
Tesla charges a $10/month subscription for its connected features, with relatively high uptake because its software is actually great (unlike the dogshit UX of most cars), so it doesn't need to sell data. Plus it just isn't how Tesla operates.
I never thought I would say that, but I would rather have my data hoarded by a crazy rightwinger Elon, than by Stellantis or VW or BMW or Hyundai or any Chinese vendors and being sold to each other plus to a dozens of incompetent or malicious middleman contractors like the one pwned recently in USA. I mean, both alternatives are crap, but 1 piece of crap is slightly better that 100 pieces of crap for the same cost. PS: never owned anything by Elon.
I wonder how long that will last. That may be their privacy policy today, but AFAIK that's merely a policy, not a binding agreement. I don't know whether anything stops them from changing their mind later, i.e., the classic rug-pull.
I appreciate Tesla's position on the matter, but I'd still rather have the collection and dissemination of the data more tightly regulated by law.
Since when is Tesla software great? Every time I get into a Tesla I have to spend five minutes to pair my iPhone over Bluetooth like it’s 2010. I then have to place my phone on the wireless charging pad and enjoy navigation on the small screen of my phone since it doesn’t support CarPlay. I have to make a playlist of my music before the trip since I can’t control my music safely.
Because HN/nerds like to think of ourselves as objective, open to the truth and data driven results. Then we find out, we're no better than the average, just different topics.
This is not a conspiracy, just normal human behaviour. The loud voices are loud. People are complaining about cars that do collect data. Do you see ANY comments about any manufacturer that doesn’t do this?
The only time I’ve ever seen a comment like that was regarding older used cars.
All it can tell us is that maybe this is something tesla should market (if it’s true) rather than bullshit like “self driving”
I’m not against self driving cars, but if I can’t sit in the back of the car, legally, and read a book while it drives me to work, it’s not self driving is it?
Two different things are getting called "car data" here.
Facts about the car: VIN, spec, recall status, odometer. Attested by someone other than the owner. Outlives every owner and the owner is the last to have it, if at all.
Facts about the driver: speed, location, timestamp. Thats what GM sold, the fix is to not collect it but OEMs seem to take 'anonymization' approach.
The DRIVER act treats both as the same which is why it fails to fix anything. The second needs a ban. The first needs the opposite - especially as we take the driver out of the vehicle - an authoritative record of the vehicle. How do we expect AVs to have adoption when the only safety certification is the company's press release?
Like I've said here before: we need to push for legislation that bans the sale of consumer data collected by websites and manufacturers to third-parties.
We need a solution, not a Band-Aid like the "Free Car Act." I believe that legislators are deliberately coming up with legislation that mildly hinders, but in no way resolves the issue in order to keep their sugar-daddies freewheeling.
And the DMV (Department of Motor vehicle Services) has also sold registration data. In California, and Texas, they have been fined for this - I'm unsure they aren't completely barred from using a loophole to still do that.
This is why I'm a vocal advocate for having an LLC own any vehicles you might drive. It protects you from the license-plate reading lookup as well from Flock et all. Though I don't know it guarantees you can't be looked up by insurance it's resistance by one more bit of friction. The vehicle I drive now is an old 2012 Lexus owned by Montana LLC and it also has no smart technology and very little insurance costs.
In California you can post a surety bond in lieu of insurance. I'm sure the same applies in other states with governance that is not captured by corporate interests.
Can you elaborate on this some? Afaik insurance is the only thing they would accept. I think insurance is generally a nasty scam so anything to get away from it would be pretty neat
You have to deposit $75,000 to the DMV and if you get in an accident where you're at fault you will also be on the hook for damages beyond that. You can also get a surety bond for that amount, instead of doing a cash deposit.
It used to be 35k but it was increased in late 2024 (which is good because it hadn't increased since the 70s).
But to do that you really have to hate insurers or be uninsurable. Because realistically putting that 75k in a basic HISA will yield enough interests to pay for regular car insurance and you get to keep your 75k.
Thats quite a lot more than i expected, i just have never had a good experience with insurance, everything is a long drawn fight. Probably not worth it unless under specific circumstances
They don't ask for license plates. At least through a camera tech like Flock, it isn't super easy to pick up a vin. So thinking this through more, at least having an insurance agency have your vin isn't as bad as having a flock & flock affiliated agency have your license plate - because if flock & flock affiliated dont have your vin they may never have the vin to find you via insurance company.
Just don’t get a car with connected internet, or smart X in any way, which is most modern cars unfortunately, and if you do, disable the telemetry. I have a clean, cool, low mileage ~15yo car, has no screen or apps, no internet, no back camera or even digital dashboard. I put a screen that has offline CoMaps app, if I ever needed it, and its OBD connected to a local app that does usual diagnostics. Sure, there’s logging I see and it happens, but it’s all local and never shared let alone connect things gas or odometer or driving habits.
I'd like to point out that the CA assembly has passed AB-1542 and it is likely going to be signed by the governor this week. This would make the sale and sharing of "sensitive" personal information illegal, and one of the sensitive personal categories is geolocation data that can map an individual to within a 1850-ft radius.
In my understanding, this pretty much makes this type of driver data illegal to sell or share. CalPrivacy's enforcement division has their eye on connected car manufacturers already, so we'll see what they do with that.
Not true. If they do that they are violating the law and that will show up in the audits. They have to delete the data, all records associated with that identifier, now including any 3rd party data that they bought from other brokers and did not collect or buy originally. There have been many loopholes for years but they are all being closed.
If you'd like to buy this data, go talk to the guys over at Inrx. They will happily give you a product demo showing point to point trips recorded by connected onstar or whatever corresponding manf connected car service.
233 comments
[ 35.8 ms ] story [ 316 ms ] thread- Chat Control law, now all messaging must be intercepted and monitored.
- eIDAS law, mandating that web-browser vendors must now accept state issued root certificates, so that states can selectively and without any legal procedure deploy MITM attacks at will.
- ADDW law, mandating that all new cars must a permanent mandatory camera and microphone surveillance module inside a car, which can't be disabled by law (bye-bye insurance if you will). There also other fun things in it like mandatory autobraking, mandatory auto lane-assist etc.
- ProtectEU laws, demanding backdoors to emails and such (maybe it's the same as Chat Control, not sure).
- AI Act legalizes AI surveillance over CCTV recordings without any judicial approval.
- European Media Freedom (duh) Act legalizes deployment of shit like Pegasus against journalists.
I'm pretty sure I'm missing a lot here too. You get the picture. EU is getting fast track into Stazi 2.0, everyone is fine with it, "because children" /s
There is no EU law that mandates "all messaging must be intercepted and monitored."
There is no EU law mandating permanent, non-disableable cameras and microphones in cars.
ProtectEU is not a law, not related to email and does not demand any "backdoors."
The AI Act bans real-time facial/biometric recognition in public places... which is a good thing. It does not "legalize AI surveillance"... quite the opposite.
EMFA does not authorize the deployment of spyware and they have publicly condemned the use of Pegasus specifically.
Right now I am repairing old car that does not track me, does not film me and doesn’t try to drive me. It’s a such a great joy to drive it without stupid beeping and automatic wheel movements. Especially without suicidal steering in construction sites when the modern system fails.
Chat Control - a) it is a law, mandatory in whole EU (because it is a "EU Regulation", and that is a law); b) I was indeed to broad and made a mistake, for now only not E2EE messages must be intercepted and monitored. E2EE is on a the chopping block in Chat Control 2.0 which is being drafted, in progress.
Advanced Driver Distraction Warning (ADDW) - a) it is EU Regulation and so it is a law; b) ADDW mandates a non-disableable surveillance camera (not sure about microphone) inside a car.
ProtectEU is indeed Chat Control plus extra, so here I was incorrect. Encrypted emails are temporarily safe, until Chat Control 2.0 is passed. And given how they bruteforced CC 1.0 in multiple blatant retries, it will eventually pass.
Regarding EU AI Act you are replying to something I didn't write. Sure it doesn't allow real-time surveillance. I wrote that it does allow surveillance over the recorded materials. This technicality allows passing all video through storage, then monitor suspects via AI programs all without judicial approvals.
And finally EMFA does authorize deployment of the spyware against journalists in cases of investigating a crime carrying 3= years penalty. Do I need to spell out how laughable that is? Practically any national security crime carry similar or heavier penalties and govt. can start a very broad and arbitrary investigation for any reason. This means that the matter of starting surveillance is a small technicality really with zero oversight.
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=PI_... https://medium.com/@shahadilh18/your-car-will-soon-watch-you...
ChatControl 2.0 is exactly "all messaging must be intercepted and monitored" ...
Some of it probably is a slippery slope argument however that slippery slope has materialized already in other areas ... And security plays a role here as well. Maybe the camera/software/system is mandated not to identify driver (as is written in ADDS "spec") but atrocious security the modern car has would probably allow for that somehow...
If you are a CA resident you can also get on the state's DROP platform to request that all registered data brokers delete your data, but it's only for deletion and not the other 4 types of data requests allowed under the CCPA (right to know, right to collect, right to opt out, and right to limit use).
Either via permanent 4G/5G link or during service intervals in the shop.
Source: I analyzed these data as an intern for one.
Surely its not sending backup camera footage, chair recline position, turn signal usage.
https://youtu.be/Ft12aZffCEg?si=qP1J5k6RXAxmZChf
https://youtu.be/SeMZGICNSMg?si=-YLnt5Q477xpFbra
https://youtu.be/8Kp108x4tQA?si=j7JV-_Dpl5afP99F
But it never is economical or more environmental friendly.
Whatever I saved on my old car compared to a newer one will never be less than the theoretical fuel savings on a newer car. Repair costs will never be as much (assuming you buy a popular repair friendly car). And nothing new needs to be built for me either.
Talking as an eastern european: unless you live in a sunshine place (~Mediterranean) most of the 90s car already eaten by the rust + the salt used for defrosting on roads in the winter.
Sure _everything can be fixed_ but then your car becomes a hobby and might not everyone has an attitude and time for that.
You can still find good examples in the UK where we have salted roads. I've paid for mine to be dinitroled. Pot holes etc are a problem here and they will affect newer vehicles too and used to go through a tyre a winter.
Obviously it would be better to have this action be illegal. But with legal privacy protections eroding in the US and other countries, it seems prudent to have a better understanding of the systems involved in the immoral surveillance.
I'm not sure what the solution is, but it's not going to be market based if you look at any recent trends. Interest in privacy is unfortunately a niche concern outside of places like HN.
Anyone who has tried to market a privacy oriented product knows what I am talking about.
I imagine its friction and not indicative of interest itself.
The fact that you even said that with a straight face. If you buy a Tesla in >2025 you’re morally bankrupt. Yeah… I’d rather my data get sold than support any Musk-led company.
Just like musk, props on the consistency
https://www.reuters.com/technology/tesla-workers-shared-sens...
It can't. Not realistically.
It can be stopped by legislation. But that would require politicians who have our interests as a priority rather than the various industries. So not going to happen anytime soon.
2. Car companies bypass CarPlay/Android Auto with their own head units with software that executes before the projection software does.
Can I disable all data collection from my vehicle?
https://news.ycombinator.com/item?id=47967786
I'm going to pirate shit until this is fixed.
Unless you’re of the opinion that since it’s data, it’s not stealing?
Or: "All companies are essentially gigantic conglomerates eating each others' food by selling my own and others' data to each other, so I basically have rights to their claimed assets anyway."
Or: "No company or government respects my privacy or property rights, so why should I respect theirs?"
I have a seven year old Volkswagen, not financed. I'm security conscious and made sure to disable all the data collection I could find in the companion app before removing my account, turn off remote access services, dig through the infotainment to turn off what I could, etc.
Last year I requested a Carfax on it, and one of the fields in the request was current mileage. I entered an estimate like 75000 miles. On form submission, that field failed validation with red subtext along the lines of 'this is less than the last reported mileage of 75345, reported <5 or so days prior>'. Checking my odometer and looking at my past few days' trips, that was indeed accurate.
The car hadn't been to a shop or out of my possession in weeks, so I can only assume the telemetry was still dialing home and selling to third parties despite my best efforts to disable it.
It works. Most people are happier focusing and holding forth on that and repeating familiar statements than they are talking to congressional staff about policy.
Your car that you paid a lot for and you like and have positive useful experiences with every day? That’s going to be way farther down the list of things to worry about.
isn't it not-funny that the super-invasive Google profiling and ID checks are also part of "Google Play" ?
You can see a map of these nodes with https://wigle.net/
While LG TVs send a lot of private data when connected to the internet, I'm not aware of any credible reports that they automatically connect to open or partner-provided wifi networks automatically.
It has not been demonstrated actively in use, only that it is possible and trivial to implement. Statement with regards to it being demonstrated retracted.
I stand by the concept that any consumer IoT device could join these networks, and the end user would never know. The only legal solution to this problem statement is to physically disable the radio on the device if assurance is desired.
This depends a lot on the region/country. IN the US, open WiFi is unusual but it's pretty common in parts of asia, for example.
There's an exceedingly common type of failure I have seen myself in industrial electronics and (has happened with Tesla at least once), that some module keeps a log of some kind in a nonvolatile flash, and this flash has a limited lifecycle, which the equipment reaches at some years into its life (or earlier, if the flash came from a bad batch, or more logging happens than planned).
At this point the board usually gets bricked and replacement is very hard due to cryptographic handshakes between components.
Manufacturers use this capacity as an excuse to push more adtech penny and dime data abuse, knowing half the world will blame the government.
iPhone 14+ and Android 12+ https://en.androidsis.com/How-to-activate-automatic-accident...
Generally I read your comment that a dropped phone only hits the floor once, therefore there is only one vector and the car always overturns/flips/turns and therefore there are multiple vectors measurable in the car?
I am not convinced yet, it might be possible without GPS, at least to some degree of error (false positives and false negatives). The info in the link requires GPS to be switched on. hmm
1. https://learn.sparkfun.com/tutorials/gnss-chip-antenna-hooku...
uh-oh
One of the most extreme understatement in history.
This is never enough. You can't trust a software switch. You need to remove the hardware capability if you want to make sure the car isn't spying on you. In the best case, the telematics box has it's own fuse, and that may be enough. In other cases, you need to find the box and unplug it. The service manual will have it's location. In some cars it's easily accessible, in others less so and you need to remove the glove box or part of the dash. Dealers will probably refuse to do it, my advice would be to DIY or find an independent mechanic who will do it.
https://imgur.com/a/AR2iLjw
https://www.tacomaworld.com/threads/simpler-solution-for-dis...
The most reliable way to permanently silence the cellular modem is to pull the relevant fuse. In the above case, this also disables the microphone, which I think is a positive. Unplugging the DCM entirely, however, seems to disable to right speaker, which is wired through the DCM for some reason.
(Yeah, technically horrible but I’m sure someone will find a way)
[1] https://patents.google.com/patent/US3771159A/en
I'm cynical, but unnecessarily coupling the ability to send telemetry with some feature people definitely want seems like exactly the sort of thing that would be done intentionally.
This is to provide cell phone audio during calls – if you're already inside your dashboard to remove the DCM (modem), there is an easy pin-out to restore the right speaker's music audio (which varies across Toyota models, but usually is as simple as placing a jumper across two pins of the unplugged wiring harness.
You could probably find some interesting info if you send out some privacy requests through the chain. LexisNexis and Verisk are consumer reporting agencies, so they have to provide you a disclosure on request. Start there.
My car is from 2011 and I do wonder if there is any telemetry in it.
I could see a fuse for cellular comms, be presumably that would also disable maps, contacting emergency services in an accident, etc. which might be an acceptable tradeoff.
I thought, I wonder if it’s the same guy? Sure enough.
Stop it.
So fucking do it! Who died and made you the style police?
> Stop it.
He's making reasonable points, in a readable fashion.
You, on the other hand...
What's your point? AI bad? Srsly, is that all you've got?
>The fuse stops it but the real issue is the owner is the only one without the record.
>Your mileage went from VW->telematics vendor->broker->carfax, thats the chain it usually follows. The fuse stops it but the real...
Prior commentary advised removing the fuse to stop the telemetry. This comment points out that the chain of information flow precludes the owner of the car.
I read this as:
"Removing the fuse that provides power to the telematics module can stop data collection from a vehicle, but the real issue is that the putative owner is the only one who isn't instantly privy to all of the collected data."
I've been handed a Carfax on my own car that has a reported mileage much greater than the actual mileage on the car, and the car has not been out of my possession.
You should have an empty glovebox as well when you take it in for service if you don't trust the shop.
If you have registration / insurance paperwork, you're now on that shop's mailing list and can expect to get "$15 off your next oil change ..." flyers in the mail.
In other news, I think I'll be taking a trip to somewhere down south to find a nice, used 1999 F350 dually with a manual transmission, since they're going to cease to exist shortly...
Every business likes data collection, until they don't.
My main motivation to get a better car was, DD goes to a super prestigious college and it seems degrading to put their bumper sticker on a 23 year old car! But I guess I won't get another car. Serves you right mfr mfrs!
Random Public data:
Honda sold data on roughly 97,000 cars to Verisk for $25,920—amounting to about 26 cents per car.
Hyundai sold data on about 1.7 million vehicles for roughly $1 million—about 61 cents per car
It would be cheaper to do nothing if that were true.
Selling it is pure icing on top.
Then someone offers them $1 each for a fleet of 1M cars, who is going to turn down $1M for a few TB of data?
To your second point, surely they’ve considered the hit to their relationship with their customers before selling for $1/car. Surely the trust between them and their buyers is worth far, far more than that.
Even assuming maximum greed, is every car manufacturer really so short-sighted as to break that trust for so small of a return?
Rather than saying "give us 1$ and we'll sell you a customer's data" it was more like "provide the navigation software and we'll let you keep the data". It probably seems like an elegant solution: as long as the driver needs navigation they "pay" for it with their data. It's really no different from how gmail or facebook works.
something around 50% of Uber's profits now come from their "private" owned insurance Company. That, of course, does not have to disclose how they are making money. Even though Uber is their only customer.
There is probably some sort of similar deal happening here.
Android Auto, Apple CarPlay, OEM mobile app...Bluetooth??
Consider the business case of leased Comcast modems broadcasting open side-channel xfinitywifi SSIDs...essentially everywhere.
Not necessarily. Obligatory roadworthiness test collects this data.
It's still better than other modern cars though? I think.
> third-party partners process information about you and how you use our services, including clicks and screen recordings, using first and third-party cookies, pixels, and similar technologies
Corporations have profiles on citizens that makes the Gestapo or the KGB seem uninformed in comparison. There is no freedom when the people in power know everything about you.
I appreciate Tesla's position on the matter, but I'd still rather have the collection and dissemination of the data more tightly regulated by law.
https://www.tesla.com/legal/privacy
All it can tell us is that maybe this is something tesla should market (if it’s true) rather than bullshit like “self driving”
You should go try it. Do a free test drive with FSD next time you have a free hour. You'll stop using the scare quotes.
Facts about the car: VIN, spec, recall status, odometer. Attested by someone other than the owner. Outlives every owner and the owner is the last to have it, if at all.
Facts about the driver: speed, location, timestamp. Thats what GM sold, the fix is to not collect it but OEMs seem to take 'anonymization' approach.
The DRIVER act treats both as the same which is why it fails to fix anything. The second needs a ban. The first needs the opposite - especially as we take the driver out of the vehicle - an authoritative record of the vehicle. How do we expect AVs to have adoption when the only safety certification is the company's press release?
We need a solution, not a Band-Aid like the "Free Car Act." I believe that legislators are deliberately coming up with legislation that mildly hinders, but in no way resolves the issue in order to keep their sugar-daddies freewheeling.
This is why I'm a vocal advocate for having an LLC own any vehicles you might drive. It protects you from the license-plate reading lookup as well from Flock et all. Though I don't know it guarantees you can't be looked up by insurance it's resistance by one more bit of friction. The vehicle I drive now is an old 2012 Lexus owned by Montana LLC and it also has no smart technology and very little insurance costs.
And they're stautorily exempted from a whole boatload of privacy laws, like HIPAA.
It used to be 35k but it was increased in late 2024 (which is good because it hadn't increased since the 70s).
https://www.dmv.ca.gov/portal/vehicle-registration/insurance...
But to do that you really have to hate insurers or be uninsurable. Because realistically putting that 75k in a basic HISA will yield enough interests to pay for regular car insurance and you get to keep your 75k.
In my understanding, this pretty much makes this type of driver data illegal to sell or share. CalPrivacy's enforcement division has their eye on connected car manufacturers already, so we'll see what they do with that.
https://leginfo.legislature.ca.gov/faces/billHistoryClient.x...
https://privacy.ca.gov/drop/