Connected cars pose privacy issues, Quebec report says

Modern vehicles have become complex digital hubs that constantly track and record what you do. Those are the findings published in a new report by Quebec’s commission on ethics in science and technology. “We wanted to map out the risks and challenges associated with connected vehicles,” said Luc Bégin, president of the commission.

“Today’s cars are essentially computers on wheels.” Many smart or connected cars have sensors, cameras and microphones collecting data both inside and outside the vehicle. The 64-page report identified 12 major privacy risks, including cybersecurity, location tracking and unfair insurance practices. For example, “safe driver” insurance programs track drivers in exchange for discounts, but they can be highly unfair, says the latest report.

Computer algorithms often penalize people who drive at night or travel through specific neighbourhoods, which raises insurance rates for low-income shift workers. Insurance companies don’t disclose how clients are scored, preventing them from disputing a bad score, the report says. Data collected by vehicles is stored on external cloud servers run by third-party providers.

The report says each point of transfer and storage is a potential target for hackers, and there is a lack of transparency on how the data is protected. This could even lead to national security issues, said Bégin. The report points to a massive security failure in 2024 where an Amazon Web Services (AWS) cloud database was left unsecured, exposing the GPS history and sensitive information of roughly 800,000 Volkswagen electric vehicles to the public for months.

Location data can be dangerous in the wrong hands, Bégin said, as the report raises concerns around domestic violence and coercive control. Abusers can use car location apps to secretly and invisibly track, stalk, and control their partners, the report notes. Researchers found many are not aware of the risks as only about 7 per cent of consumers read the terms and conditions, which are “excessively long,” vague and difficult to read.

“There is a great deal of opacity surrounding this issue right now,” said Bégin. “Yes, the person consents, but does the person always fully understand what they’re consenting to?