Data about our daily lives is routinely collected, aggregated, reported, sold, and hacked. Very little, if any, of our data is actually private. Add to this complex mix the rapid rise in the use of artificial intelligence and generative artificial intelligence to scrape, ingest and apply search routines and options, plus post election directives to cease regulatory processes, and you have an escalating privacy nightmare on wheels.

The public is increasingly familiar with the scale of data collection, surveillance, marketing and sale, and privacy violations that routinely occur when using apps, browsers, social media, the internet, and cell phones. But extensive data collection and privacy violations also routinely occurs when we use cars and trucks [regardless of manufacturer], much if not all of it likely without your knowledge or consent. As EFF states, “If you’ve purchased a car made in the last decade or so, it’s likely jam-packed with enough technology to make your brand new phone jealous.” In many instances, vehicles use onboard technology, ‘black boxes’, to collect data, but cell phone apps also provide critical data collection operations that seamlessly and continuously harvest your information, without your knowledge, or your consent. Privacy statements are buried in terms of service on everything you use, and for the most part, are automatically set to “opt-in,” requiring you to locate and “opt-out” of processes which in many cases, will continue regardless of your actions. In addition data collection technology is deployed by police departments around the country who are collecting, aggregating and operationalizing your travel activities using automated license plate readers. Some drivers are using obfuscation techniques to prevent license plate tracking systems, but this technique is rendered useless when mass data collection technology is used on targeted groups.

Automaker data collection and tracking can be even more extensive than what is deployed to track your activities online. Vehicle data collection has multifaceted impact, including setting and increasing your insurance costs, identifying all destinations of travel, the dates and times, the speed at which you travel, medical or health service locations you have visited, where you eat and shop, and even engagement with political, legal and religious causes, groups and actions. Some vehicles, such as Telsa, have 24/7 mobile camera monitoring inside and outside of the vehicle, and “records audio and video footage every time the vehicle is in motion.”

The following selected articles and abstracts will inform you about how, where, when and by whom your transportation data is collected, and ways in which is it used, and sold. It is important to acknowledge that aggregating and selling your data is a very large and lucrative business. Companies selling subscription and contractual access to extensive high profile risk databases include LexisNexis Risk Solutions, Verisk, and Mobilewalla, and the customers for these data include the private sector as well as local, state and federal government.

The citations and abstract in this article are in chronological order, starting with the most current. I will continue to update this article with relevant information becomes available.

Subaru Security Flaws Exposed Its System for Tracking Millions of Cars. Wired, January 23, 2025. Now-fixed web bugs allowed hackers to remotely unlock and start any of millions of Subarus. More disturbingly, they could also access at least a year of cars’ location histories—and Subaru employees still can.

Subaru security vulnerability allowed millions of cars to be tracked, unlocked, and started. 9to5Mac, January 23, 2025. A Subaru security vulnerability allowed millions of cars to be remotely tracked, unlocked, and started. A full year’s worth of location history was available, and was accurate to within five meters … Security researcher Sam Curry reached an unusual deal with his mother: he would buy her a Subaru if she would let him try to hack it. He started by looking for flaws in the MySubaru Mobile App, but couldn’t find any. He didn’t stop there, however.

From my past experience with car companies, I knew there could be publicly accessible employee-facing applications with broader permissions than the customer-facing apps. With that in mind, I decided to shift focus and started hunting for other Subaru-related websites to test.

A friend helped him find a promising-looking sub-domain. It of course required an employee login, but some digging around in a Javascript directory revealed insecure password reset code. All they needed then was a valid employee email address, which they found with a quick web search. They reset the password, and were then able to login. The one remaining barrier was 2FA protection, but this turned out to be trivial to defeat, as it ran on the client side and could be removed locally. At that point they were in.

The left navbar had a ton of different functionality, but the juiciest sounding one was “Last Known Location”. I went ahead and typed in my mom’s last name and ZIP code. Her car popped up in the search results. I clicked it and saw everywhere my mom had traveled the last year.

It appeared that they could also remotely take control of any Subaru with Starlink installed, and they tested this by getting permission to target a friend’s car.

Your car knows more about you than you think. January 17, 2025. Automakers are collecting a treasure trove of data on the people driving their cars — and often selling that data to third parties. CNN via MSN, January 11, 2025. There’s a good chance your car knows all about you. Where you’ve been. How fast you drive. If you could’ve been a little easier on the brakes. Even what you look like, thanks to cameras pointed right at your face. This kind of data collection has been going on for years. And, in some cases, the data has been sold by automakers to third parties, such as insurance companies, which have used the data on driving habits to hike insurance rates for some customers. It also has been used by law enforcement, with the most recent prominent example being the Tesla Cybertruck that was exploded outside of the Trump International Hotel in Las Vegas on New Year’s Day. Law enforcement officials investigating the incident have thanked Tesla for turning over data quickly about the suspect, who killed himself while in the truck. “I have to thank Elon Musk specifically,” Las Vegas Sheriff Kevin McMahill said at a news conference, noting that the Tesla CEO gave authorities “quite a bit of additional information,” including directly sending them video from Tesla charging stations to help with their efforts to track the driver. But while law enforcement praises corporations for handing over driver data, others are concerned that most of the information collected could be violating people’s privacy. They’re concerned that without limits, potential privacy invasions will only get worse, with automakers standing to make money off the treasure trove of information they now possess.

Allstate used GasBuddy and other apps to quietly track driving behavior. Ars Technica, January 14, 2025. “Texas has sued insurance provider Allstate, alleging that the firm and its data broker subsidiary used data from apps like GasBuddy, Routely, and Life360 to quietly track drivers and adjust or cancel their policies. Allstate and Arity, a “mobility data and analytics” firm founded by Allstate in 2016, collected “trillions of miles worth of location data” from more than 45 million people, then used that data to adjust rates, according to Texas’ lawsuit. This violates Texas’ Data Privacy and Security Act, which requires “clear notice and informed consent” on how collected data can be used. A statement from Texas Attorney General Ken Paxton said the suit is the first-ever state action targeting comprehensive data privacy violations. “Our investigation revealed that Allstate and Arity paid mobile apps millions of dollars to install Allstate’s tracking software,” Paxton said in a statement. “The personal data of millions of Americans was sold to insurance companies without their knowledge or consent in violation of the law. Texans deserve better, and we will hold all these companies accountable.”

Inside the Black Box of Predictive Travel Surveillance. Wired, January 13, 2025 – “Behind the scenes, companies and governments are feeding a trove of data about international travelers into opaque AI tools that aim to predict who’s safe—and who’s a threat… In Europe, at least four technology companies—Idemia, SITA, Travizory, and WCC—offer governments around the world software that uses algorithms on traveler data to profile passengers. These companies claim their software can detect terrorists, human traffickers, drug dealers, serious criminals, missing persons and increasingly, people migrating without papers. Products from these companies aim to combine multiple data streams about a traveler—such as your flight booking data with your visa application—to allow some people to pass quickly and effortlessly through border control. Those flagged by a machine as risky would be sorted into separate lines and subjected to a variety of measures ranging from questioning to physical searches and even possible surveillance by intelligence agencies. It would be difficult, if not impossible, in many countries to find out why you were flagged or what happens afterwards with your data…”

Cars (and Drivers): 2024 in Review, EFF, December 29, 2024: “If you’ve purchased a car made in the last decade or so, it’s likely jam-packed with enough technology to make your brand new phone jealous. Modern cars have sensors, cameras, GPS for location tracking, and more, all collecting data—and it turns out in many cases, sharing it. Cars Sure Are Sharing a Lot of Information – While we’ve been keeping an eye on the evolving state of car privacy for years, everything really took off after a New York Times report this past March found that the car maker G.M. was sharing information about driver’s habits with insurance companies without consent. It turned out a number of other car companies were doing the same by using deceptive design so people didn’t always realize they were opting into the program. We walked through how to see for yourself what data your car collects and shares. That said, cars, infotainment systems, and car maker’s apps are so unstandardized it’s often very difficult for drivers to research, let alone opt out of data sharing. Which is why we were happy to see Senators Ron Wyden and Edward Markey send a letter to the Federal Trade Commission urging it to investigate these practices. The fact is: car makers should not sell our driving and location history to data brokers or insurance companies, and they shouldn’t make it as hard as they do to figure out what data gets shared and with whom. Advocating for Better Bills to Protect Abuse Survivors – The amount of data modern cars collect is a serious privacy concern for all of us. But for people in an abusive relationship, tracking can be a nightmare…”

You shouldn’t be driving over 100 mph and your car shouldn’t let you. Fast Company, December 23, 2024 – “The traffic signal on North Las Vegas’s North Commerce Street had been red for at least 29 seconds, but the Dodge Challenger did not slow down. Instead, it flew through the intersection with Cheyenne Avenue at 103 mph, almost three times the 35 mph speed limit. Carnage ensued. The crash that occurred on January 29, 2022, was horrific. The Challenger, driven by Gary Dean Robinson, slammed into the right side of a Toyota Sienna minivan crossing the intersection. Robinson and his passenger were killed, as were all seven people in the minivan (including four children). Erlinda Zacarias, the mother of four of the crash victims and sister to another, told the local CBS station that her family was returning from a visit to a park. “I kept calling everybody’s phone because all of them have phones and nobody answered me,” she said. Fearing the worst, she drove toward where she imagined her family might be and soon found the crash site. “I started screaming,” Zacarias said. Over 100 Americans die in traffic collisions on an average day, but 9 fatalities from a single incident is exceptional. Crash investigations are typically handled by local authorities, but in this case, the National Transportation Safety Board (NTSB) also launched one of its own. In its findings and recommendations, which were released last week, NTSB placed blame on Robinson, whose body showed evidence of PCP, alcohol, and cocaine. Robinson also had a history of reckless driving, leading NTSB to cite “Nevada’s failure to deter the driver’s speeding recidivism.” Those findings and related recommendations were unsurprising. But NTSB’s investigation summary also included something else: The agency recommended that automakers install technology on all new cars that can prevent reckless speeding—and, for the first time, called on the National Highway Traffic Safety Administration to mandate it.”