Data collected by cars and sold to third parties (theverge.com)

336 points by bookofjoe 14 hours ago

bitparadox 13 hours ago

I posted a flavor of this comment on an article a few months ago, but it's relevant here:

I have a seven year old Volkswagen, not financed. I'm security conscious and made sure to disable all the data collection I could find in the companion app before removing my account, turn off remote access services, dig through the infotainment to turn off what I could, etc.

Last year I requested a Carfax on it, and one of the fields in the request was current mileage. I entered an estimate like 75000 miles. On form submission, that field failed validation with red subtext along the lines of 'this is less than the last reported mileage of 75345, reported <5 or so days prior>'. Checking my odometer and looking at my past few days' trips, that was indeed accurate.

The car hadn't been to a shop or out of my possession in weeks, so I can only assume the telemetry was still dialing home and selling to third parties despite my best efforts to disable it.

torginus 9 hours ago

Tangential, but one of the concerns I have about these 'smart' cars is they have an expiration deadline.

There's an exceedingly common type of failure I have seen myself in industrial electronics and (has happened with Tesla at least once), that some module keeps a log of some kind in a nonvolatile flash, and this flash has a limited lifecycle, which the equipment reaches at some years into its life (or earlier, if the flash came from a bad batch, or more logging happens than planned).

At this point the board usually gets bricked and replacement is very hard due to cryptographic handshakes between components.

aceazzameen 9 hours ago

They've become cell phones on wheels. I'm disappointed with what vehicles (and phones too!) have become.

taraindara 9 hours ago

drnick1 9 hours ago

> turn off remote access services, dig through the infotainment to turn off what I could

This is never enough. You can't trust a software switch. You need to remove the hardware capability if you want to make sure the car isn't spying on you. In the best case, the telematics box has it's own fuse, and that may be enough. In other cases, you need to find the box and unplug it. The service manual will have it's location. In some cars it's easily accessible, in others less so and you need to remove the glove box or part of the dash. Dealers will probably refuse to do it, my advice would be to DIY or find an independent mechanic who will do it.

jasonjayr 7 hours ago

Find the telematic's antenna, and put a 50ohm resistor across it. It can scream into it's own private void.

drnick1 6 hours ago

snypher 7 hours ago

samsullivan 9 hours ago

Your mileage went from VW->telematics vendor->broker->carfax, thats the chain it usually follows. The fuse stops it but the real issue is the owner is the only one without the record.

You could probably find some interesting info if you send out some privacy requests through the chain. LexisNexis and Verisk are consumer reporting agencies, so they have to provide you a disclosure on request. Start there.

andy99 6 hours ago

So I first read this comment and thought is looked like AI and thought I’d give the benefit of the doubt. Then I saw this where there is no doubt: https://news.ycombinator.com/item?id=49687774

I thought, I wonder if it’s the same guy? Sure enough.

Stop it.

CommenterPerson 4 hours ago

zephen 5 hours ago

e40 8 hours ago

Is there usually a fuse that just turns off the telemetry? I would be surprised if that is the case. I could see the design being "if you turn this fuse off to turn off telemetry, you'll also lose these functions: ..." and if they did it "right" they'd make the car non-functional.

My car is from 2011 and I do wonder if there is any telemetry in it.

brookst 7 hours ago

skywhopper 6 hours ago

samsullivan 7 hours ago

publlus_enigma 5 hours ago

Weird -- usually VW likes to falsify its data, so I am surprised this data was so accurate.

Every business likes data collection, until they don't.

CommenterPerson 4 hours ago

I have been thinking of upgrading from my 2003 Corolla to an electric (not Tesla). The Corolla hasn't had a single repair problem in 23 years!

My main motivation to get a better car was, DD goes to a super prestigious college and it seems degrading to put their bumper sticker on a 23 year old car! But I guess I won't get another car. Serves you right mfr mfrs!

kaladin-jasnah 4 hours ago

See my other comment, but the fuse pulling stuff still works on GM EVs and disables connectivity, but the telematics unit may still be collecting offline to batch upload.

steelframe 3 hours ago

This is why I pulled the fuse on the Data Communications Module (DCM) on my car. The device that transmits the telemetry simply doesn't get any juice.

vikingerik 11 hours ago

All it would need is a wi-fi antenna internally, and then it could connect to an open wi-fi network anywhere. And it's going to be pretty much impossible to avoid ever driving your car within range of some open network.

10000truths 9 hours ago

It would have to find an open Wi-Fi network that isn't gated behind a captive portal, which is very rare. Rare enough that most telemetry would be too stale to be useful.

mixmastamyk 9 hours ago

baby_souffle 6 hours ago

wcunning 6 hours ago

Lots of automotive OEMs want that specific kind of information for generic reasons (how many of what model made it to what mileage under what circumstances) that are entirely reasonable. Lots of them also want that info for warranty related reasons (you've hit the mileage limit and we won't do anything for you anymore). But, my state of Michigan is starting a program to evaluate replacing registration fees with mileage charges to account for the additional wear and tear on the roads from EVs that don't pay gas taxes to fund road repairs. This would require some kind of verification of mileage, which we can't currently do during emissions testing, since it doesn't exist here. Legally required data retention is becoming a bigger and bigger issue, particularly in light of the driver monitoring requirement starting in MY27 vehicles by the Bipartisan Infrastructure Act terms. That will presumably be integrated into any black box recording in a crash and probably subpoenaed in any dispute going forward.

In other news, I think I'll be taking a trip to somewhere down south to find a nice, used 1999 F350 dually with a manual transmission, since they're going to cease to exist shortly...

hansvm an hour ago

I know you're not the culprit, but it's annoying to see crap like this (highly invasive tracking, ostensibly for slightly more efficient tax collection), when far cheaper, better efforts (like Rhode Island's attempt to add tolls for just semis -- 98-99% of their freeway maintenance costs) are killed before they have a chance to prove themselves.

noman-land 12 hours ago

Try finding the fuse and pulling it. It will be in the manual.

glitchcrab 11 hours ago

I would be very surprised if it was that simple - systems in modern cars are so interlinked that I would expect that pulling a fuse would cause something else to break, resulting in dash lights or broken functionality.

trevithick 9 hours ago

morkalork 9 hours ago

Espressosaurus 9 hours ago

Typically it’s tied to other components and pulling the fuse will take out other things like infotainment, speakers, etc.

jerlam 9 hours ago

Carfax also can report estimated mileage, but it might have a different flag in the system that allows override.

I've been handed a Carfax on my own car that has a reported mileage much greater than the actual mileage on the car, and the car has not been out of my possession.

demibabs 9 hours ago

Yet if you overestimated the mileage you would’ve been none the wiser!

sandworm101 6 hours ago

Where was the car serviced? Antennas or not, the dealer might just plug in and upload everything during service.

baby_souffle 6 hours ago

> Antennas or not, the dealer might just plug in and upload everything during service.

You should have an empty glovebox as well when you take it in for service if you don't trust the shop.

If you have registration / insurance paperwork, you're now on that shop's mailing list and can expect to get "$15 off your next oil change ..." flyers in the mail.

Simulacra 12 hours ago

What did you do, or what are you going to do? That would piss me off until i found the antenna and broke it

trouve_search 13 hours ago

Couldn't you put some sort of faraday cage around the antenna?

anjel 12 hours ago

What happened to just pulling (the mfr's) sim card?

antonkochubey 7 hours ago

greesil 12 hours ago

citizenpaul 2 hours ago

The most horrible part this crime is I read somewhere That the amount the car companies get for spying on your locations is some pathetic paltry amount like $1-$5 one time. These car companies sell you out to insurance companies and such so they can collect data and use it AGAINST you. Ghouls everywhere now.

Random Public data:

Honda sold data on roughly 97,000 cars to Verisk for $25,920—amounting to about 26 cents per car.

Hyundai sold data on about 1.7 million vehicles for roughly $1 million—about 61 cents per car

Slow_Hand 2 hours ago

That doesn’t smell right. Why develop the telemetry and go to all of the trouble for such a paltry return? That probably wouldn’t even cover the legal consulation to cover their ass, much less go through the trouble of implementing and selling the telemetry.

It would be cheaper to do nothing if that were true.

bookofjoe 12 hours ago

"Resistance is futile." See also: LG TVs, etc.

otterley 9 hours ago

It’s not futile. Write your congressperson and state representatives. If enough people do this around the country, laws will eventually be passed to prevent it.

wwweston 9 hours ago

jboggan 5 hours ago

I'd like to point out that the CA assembly has passed AB-1542 and it is likely going to be signed by the governor this week. This would make the sale and sharing of "sensitive" personal information illegal, and one of the sensitive personal categories is geolocation data that can map an individual to within a 1850-ft radius.

In my understanding, this pretty much makes this type of driver data illegal to sell or share. CalPrivacy's enforcement division has their eye on connected car manufacturers already, so we'll see what they do with that.

https://leginfo.legislature.ca.gov/faces/billHistoryClient.x...

porkshoe 4 hours ago

Another note for Californians -- the California DROP (delete request and opt-out platform) takes VINs as one of the inputs.

https://privacy.ca.gov/drop/

samsullivan 8 hours ago

Two different things are getting called "car data" here.

Facts about the car: VIN, spec, recall status, odometer. Attested by someone other than the owner. Outlives every owner and the owner is the last to have it, if at all.

Facts about the driver: speed, location, timestamp. Thats what GM sold, the fix is to not collect it but OEMs seem to take 'anonymization' approach.

The DRIVER act treats both as the same which is why it fails to fix anything. The second needs a ban. The first needs the opposite - especially as we take the driver out of the vehicle - an authoritative record of the vehicle. How do we expect AVs to have adoption when the only safety certification is the company's press release?

tomrod 13 hours ago

How can this be stopped, from a technical perspective? Can I wrap the comms in a Faraday cage?

Obviously it would be better to have this action be illegal. But with legal privacy protections eroding in the US and other countries, it seems prudent to have a better understanding of the systems involved in the immoral surveillance.

willis936 13 hours ago

I've had good luck with pulling service manuals, finding the telematics antenna connectors, and unplugging them. It's popular to pull the telematics module fuse, but that typically disables internal microphones and GPS that are used by android auto and carplay. This severely degrades features spouses expect to just work. The antenna pulling is a much lighter touch.

chneu 11 hours ago

The amount of times I see "I'd like to do the right thing but my spouse isn't on board" is mind boggling.

It's wild how convenience trumps everything and then we look back to say, "we should have done better."

willis936 9 hours ago

classified 13 hours ago

> features spouses expect to just work

Never underestimate the risks of spousal dissatisfaction.

greenavocado 12 hours ago

You should be using a 50 ohm 1 watt dummy load / termination. It's better at attenuating the signal than leaving the antenna unplugged.

willis936 11 hours ago

dylan604 13 hours ago

I wonder if this increases or reduces the value of the car???

tomrod 12 hours ago

willis936 11 hours ago

4chandaily 5 hours ago

schmeichel 13 hours ago

It is possible to remove the hardware itself that is responsible for this, but depending on the car it can very involved: https://arkadiyt.com/2026/05/13/removing-the-modem-and-gps-f...

codedokode 7 hours ago

It definitely can be stopped. For example, China sells cars internally at cheaper prices, but they are locked to prevent using them outside the country. However, there are people who can hack and unlock them allowing operating in any country. But maybe it would be illegal in the West, I don't know. Removing the modem is an easier task.

WarmWash 13 hours ago

What sucks is that at least with my car, if you pull their access, you also lose all your remote access as well, and the ability to receive updates.

ryandrake 13 hours ago

Why does a car need "remote access" and to "receive updates?" I'd consider this a bonus side effect.

ellisv 13 hours ago

derwiki 13 hours ago

Why do you need remote access to your car? What updates does your car need?

fhdkweig 9 hours ago

slau 12 hours ago

WarmWash 13 hours ago

base698 8 hours ago

You learn animal husbandry and join the Amish.

Tepix 10 hours ago

Remember that story a week ago „everything I own, owned“? That’s one way.

forgetfreeman 13 hours ago

Simple: don't own a vehicle with this capability.

tomrod 13 hours ago

Much like owning a home without an HOA attached, it is becoming harder and harder to meet this requirement.

It also seems to conflict with `right-to-repair` laws if the capability is legally required.

forgetfreeman 2 hours ago

cucumber3732842 13 hours ago

calvinmorrison 13 hours ago

cc62cf4a4f20 14 hours ago

That‘ll happen when you don‘t have meaningful data protection laws.

BlackRabbit1 13 hours ago

All European car manufacturers pull a crazy amount of telemetry data from your car.

Either via permanent 4G/5G link or during service intervals in the shop.

Source: I analyzed these data as an intern for one.

amelius 13 hours ago

My question is why, with their protection laws, Smart TVs and Smart Cars are still sold in the EU?

thfuran 13 hours ago

Do they do the same spying on the models/units produced for sale in EU? It’s not actually a necessary part of the operation of the device, so it makes sense they’d be able to sell them without it.

Yizahi 7 hours ago

HN on average is a little behind on the general EU "privacy" stance (though I saw some recent topic about that here). EU was about privacy, a few decades ago. Nowadays it did a complete U-turn and legislates mandatory anti-privacy union-wide laws every year.

- Chat Control law, now all messaging must be intercepted and monitored.

- eIDAS law, mandating that web-browser vendors must now accept state issued root certificates, so that states can selectively and without any legal procedure deploy MITM attacks at will.

- ADDW law, mandating that all new cars must a permanent mandatory camera and microphone surveillance module inside a car, which can't be disabled by law (bye-bye insurance if you will). There also other fun things in it like mandatory autobraking, mandatory auto lane-assist etc.

- ProtectEU laws, demanding backdoors to emails and such (maybe it's the same as Chat Control, not sure).

- AI Act legalizes AI surveillance over CCTV recordings without any judicial approval.

- European Media Freedom (duh) Act legalizes deployment of shit like Pegasus against journalists.

I'm pretty sure I'm missing a lot here too. You get the picture. EU is getting fast track into Stazi 2.0, everyone is fine with it, "because children" /s

derwiki 13 hours ago

Can I invoke CCPA to get a report of and/or delete my data?

jboggan 6 hours ago

You can invoke CCPA (if applicable) and directly ask a covered business or registered data broker for an exact output of your existing information on their systems. This is honestly rare and most companies will find ways to deny you - asking for various documents to prove your identity and hoping you quit responding.

If you are a CA resident you can also get on the state's DROP platform to request that all registered data brokers delete your data, but it's only for deletion and not the other 4 types of data requests allowed under the CCPA (right to know, right to collect, right to opt out, and right to limit use).

kaladin-jasnah 13 hours ago

In my GM car I have the wonderful opportunity to pull the OnStar fuse and disable all cellular connectivity. However, I am concerned the telematics information are stored in long term storage and if I have to reconnect the fuse, all my driving will be batch uploaded. I hope not!! And the GPS still works. Maybe I can find some dummy loads as well or the antennae.

It's still better than other modern cars though? I think.

3eb7988a1663 9 hours ago

If you are willing to lose GPS, maybe you could set the car's internal clock to the year 2000. This might fool a cursory data dump that is looking for "last three months of driving habits". Would obviously not stand up to any real scrutiny, but mostly painless.

LoganDark 8 hours ago

GPS provides the time, so this probably won't work. If it ever reconnects it will just reset its clock. That's often one of the first things that any computer does after a long period of no power/connection.

3eb7988a1663 8 hours ago

sciencesama 42 minutes ago

How to stop this on Subaru ?

Cider9986 13 hours ago

Apparently Rivians can be prevented from doing this:

Can I disable all data collection from my vehicle?

https://news.ycombinator.com/item?id=47967786

hughes 13 hours ago

Terms of use to even read the article:

> third-party partners process information about you and how you use our services, including clicks and screen recordings, using first and third-party cookies, pixels, and similar technologies

aunty_helen 3 hours ago

If you'd like to buy this data, go talk to the guys over at Inrx. They will happily give you a product demo showing point to point trips recorded by connected onstar or whatever corresponding manf connected car service.

heaney-555 13 hours ago

I notice that not one comment here, nor the article, notes that this doesn't happen with a Tesla.

left-struck 10 minutes ago

This is not a conspiracy, just normal human behaviour. The loud voices are loud. People are complaining about cars that do collect data. Do you see ANY comments about any manufacturer that doesn’t do this? The only time I’ve ever seen a comment like that was regarding older used cars.

All it can tell us is that maybe this is something tesla should market (if it’s true) rather than bullshit like “self driving”

visiondude 6 hours ago

why do you think this? can you provide a written terms or similar to hold this belief? i would think they are absolutely selling all the data

qwerpy 7 hours ago

theverge doesn't like Tesla and neither do the vast majority of people here. Why provide a fair and balanced view if it helps someone we don't like?

morkalork 9 hours ago

No, you just have to worry about random employees watching the video feeds for shits and giggles

otterley 9 hours ago

Why doesn’t it happen with them?

heaney-555 8 hours ago

Tesla charges a $10/month subscription for its connected features, with relatively high uptake because its software is actually great (unlike the dogshit UX of most cars), so it doesn't need to sell data. Plus it just isn't how Tesla operates.

artisinal 39 minutes ago

otterley 3 hours ago

LoganDark 8 hours ago

polyterative 13 hours ago

My car is from 2017, so thankfully it's not.

gdulli 13 hours ago

My car is much older and I used to hope it would last forever. But now I hope it dies soon enough that when I go to replace it, the options for non smart cars haven't gone away.

hn_submit 8 hours ago

Like I've said here before: we need to push for legislation that bans the sale of consumer data collected by websites and manufacturers to third-parties.

We need a solution, not a Band-Aid like the "Freedom Car Act." I believe that legislators are deliberately coming up with legislation that mildly hinders, but in no way resolves the issue in order to keep their sugar-daddies freewheeling.

tamimio 6 hours ago

Just don’t get a car with connected internet, or smart X in any way, which is most modern cars unfortunately, and if you do, disable the telemetry. I have a clean, cool, low mileage ~15yo car, has no screen or apps, no internet, no back camera or even digital dashboard. I put a screen that has offline CoMaps app, if I ever needed it, and its OBD connected to a local app that does usual diagnostics. Sure, there’s logging I see and it happens, but it’s all local and never shared let alone connect things gas or odometer or driving habits.

mannanj 7 hours ago

And the DMV (Department of Motor vehicle Services) has also sold registration data. In California, and Texas, they have been fined for this - I'm unsure they aren't completely barred from using a loophole to still do that.

This is why I'm a vocal advocate for having an LLC own any vehicles you might drive. It protects you from the license-plate reading lookup as well from Flock et all. Though I don't know it guarantees you can't be looked up by insurance it's resistance by one more bit of friction. The vehicle I drive now is an old 2012 Lexus owned by Montana LLC and it also has no smart technology and very little insurance costs.

octoberfranklin 5 hours ago

It won't protect you from the insurance agencies; they demand a DL ID# and a VIN. And you are required by law to purchase from them.

And they're stautorily exempted from a whole boatload of privacy laws, like HIPAA.

sagarm 3 hours ago

In California you can post a surety bond in lieu of insurance. I'm sure the same applies in other states with governance that is not captured by corporate interests.

CableNinja 15 minutes ago

mannanj 3 hours ago

They don't ask for license plates. At least through a camera tech like Flock, it isn't super easy to pick up a vin. So thinking this through more, at least having an insurance agency have your vin isn't as bad as having a flock & flock affiliated agency have your license plate - because if flock & flock affiliated dont have your vin they may never have the vin to find you via insurance company.

amelius 13 hours ago

How is this not stealing?

I'm going to pirate shit until this is fixed.

kulahan 9 hours ago

You’re going to steal in response to stealing…?

Unless you’re of the opinion that since it’s data, it’s not stealing?

ZYbCRq22HbJ2y7 8 hours ago

Maybe the poster is saying, "There are no consequences for anyone acting in this way here, and we seem to be slipping ever more into societal moral decay, so why shouldn't I cheat to win?"

Or: "All companies are essentially gigantic conglomerates eating each others' food by selling my own and others' data to each other, so I basically have rights to their claimed assets anyway."

Or: "No company or government respects my privacy or property rights, so why should I respect theirs?"

Some of that is a form of "I am going to steal, because others are stealing", and well, if stealing becomes the norm, yeah, I would say the comment has some validity in a few words for the common citizen.

amelius 5 hours ago

No, this is mostly out of activism. I'm angry that the law is there for one group while the rights of another group are completely neglected. That it gives me free content is just a nice side-effect, nothing more.

Simulacra 12 hours ago

I drive a restored 2002 Citroen C5.

everyone 13 hours ago

Another reason to use a car from 90's or 2000's.. Also they wont burn oil like a modern car + more durable and repairable metal parts.

https://youtu.be/Ft12aZffCEg?si=qP1J5k6RXAxmZChf

https://youtu.be/SeMZGICNSMg?si=-YLnt5Q477xpFbra

https://youtu.be/8Kp108x4tQA?si=j7JV-_Dpl5afP99F

thrownawaysz 13 hours ago

>Another reason to use a car from 90's or 2000's

Talking as an eastern european: unless you live in a sunshine place (~Mediterranean) most of the 90s car already eaten by the rust + the salt used for defrosting on roads in the winter.

Also by my experience cars (except from SUVs) somehow never kept up with the road quality. Pot holes are a problem everywhere but you can see that certain brands for example japanese and korean ones never designed for deteriorating road quality (and I don't mean offroad) because... you know they just don't exist in the home market. So the tires, wheels, suspension are not as robust as they should be.

Sure _everything can be fixed_ but then your car becomes a hobby and might not everyone has an attitude and time for that.

wkjagt 13 hours ago

My wife's Ioniq 5 was hit on the bumper while it was parked. Took weeks for all parts to get to the dealer and cost thousands of dollars because sensors etc. if someone hit my 1981 Volvo 240 the same way I'm not even sure it would cause any noticable damage.

CableNinja 9 minutes ago

Someone forgot to set the brake in their car, rolled into the back of my dads 70ish pickup. It rolled the width of a parking row, on fairly flat surface. The car had no chance obviously, but it was pretty funny seeing the damage; bumper and fender, not just a minor one you could slap out with a good fist slam either. There was zero damage to the truck

glitchcrab 10 hours ago

The 240 is built like a brick (both in terms of strength and looks). My dad had one when I was much younger, then he sold it for a 740. A few months after the sales, police knocked on his door and asked him a lot of questions. It turned out the purchaser had used the car in a ram-raid on a shop.

wkjagt 8 hours ago

hbarka 7 hours ago

Today’s cars are safer because of the crumple zones. We romanticize the older cars but their rigidity also caused impact force to be absorbed by occupants.

wkjagt 5 hours ago

herbst 13 hours ago

I really wanted a modern car because of the fancy automation stuff, I thought.

But it never is economical or more environmental friendly.

Whatever I saved on my old car compared to a newer one will never be less than the theoretical fuel savings on a newer car. Repair costs will never be as much (assuming you buy a popular repair friendly car). And nothing new needs to be built for me either.