During the pandemic, I bought my first car in a long time so I could avoid the public transport I usually embraced when going to band practice or taking my kid to an appointment. I got a 2016 Skoda, for a bunch of reasons: I scored a good deal; I live in an apartment and Berlin’s streets didn’t yet have enough charging infrastructure for an electric; the Skoda Rapid was spacious and reasonably fuel-efficient; buying a Czech vehicle meant I could legitimately claim to have a Bohemian ride; and the thing was just old enough to not be fitted with internet connectivity and assorted privacy-busting technologies.
That last factor was really driven home (sorry) today with the release of an absolutely damning report from Mozilla. The Firefox maker looked at 25 car brands’ privacy and security and found all of them severely lacking. Cars turned out to be “the worst product category we have ever reviewed for privacy,” Mozilla’s team wrote:
“While we worried that our doorbells and watches that connect to the internet might be spying on us, car brands quietly entered the data business by turning their vehicles into powerful data-gobbling machines. Machines that, because of…all those brag-worthy bells and whistles, have an unmatched power to watch, listen, and collect information about what you do and where you go in your car.”
How bad are we talking? Kia’s privacy policy for owners (so, not just for visitors to its website) says the company may have collected and sold to third parties information about its customers’ “sex life or sexual orientation.” Nissan’s policy also says it will collect information on sexual orientation and “sexual activity,” which it may then use for targeted marketing and other purposes. Most of the car brands are happy to share information with government and law enforcement in response to a mere “request” rather than a court order and, as for security, Mozilla noted it remains unclear whether any of the cars even encrypt the data that’s stored on them.
I asked Kia why it needs to collect information about drivers’ sex lives and to whom it transmits such data; I got sent a link to a letter that the auto industry just wrote to U.S. congressional leaders via its Alliance for Automotive Innovation. The letter sings the praises of privacy principles that automakers adopted in 2014, saying they “continue to distinguish the auto industry from other industries as one dedicated to safeguarding consumer privacy.” But how is collecting information on someone’s sex life consistent with the principle of “collecting and retaining identifiable information only as needed for legitimate business purposes”?
The automakers claim their principles are so strong that they should provide the basis for that mythical beast, a federal U.S. privacy law. However, look at Kia’s European privacy policy and you will find nary a mention of collecting and selling sexual information. That might be because the EU has an actual strong privacy law in the General Data Protection Regulation, which doesn’t allow such sensitive data to be gathered without the individual’s explicit consent. The GDPR also says companies must let users delete their data, which only two of the companies Mozilla reviewed (Renault and Dacia) do, and only in Europe.
So yeah, the U.S. should by all means get a federal privacy law, but maybe automakers aren’t the ones who should write it. More news below.
Want to send thoughts or suggestions to Data Sheet? Drop a line here.
David Meyer
NEWSWORTHY
Microsoft’s AI chip investment. Microsoft is among the investors in a $110 million funding round for d-Matrix, a Silicon Valley–based AI chip startup. Nvidia’s dominance in the sector scares many investors away from such companies, but d-Matrix CEO Sid Sheth said his new backers understand “what it takes to build a semiconductor business.” As Reuters reports, the round was led by the Singaporean investment giant Temasek and vastly outstripped d-Matrix’s earlier funding of around $44 million.
EU designates Big Tech “gatekeepers.” The EU has finally specified which Big Tech services elevate their providers to the status of “gatekeeper,” meaning the services have to stick to particularly stringent antitrust rules. Microsoft’s Bing and Apple’s iMessage are off the list for now, as the companies wanted, but the European Commission is further investigating them and may yet add them. A total of 22 services are on the list, ranging from iOS, Windows, and Android to WhatsApp, TikTok, and Amazon’s marketplace.
Google antitrust settlement. Google has reached an “agreement in principle” to settle with three dozen state attorneys general over alleged antitrust abuses in its Play Store policies. The case revolves around Google’s 30% commission on sales in its Android ecosystem. As Politico reports, the case would have gone to trial in a couple months, but even if that doesn’t happen, a very similar case brought by Epic Games and Match Group is also scheduled to go to trial in November.
SIGNIFICANT FIGURES
10%
—The percentage of global revenue that social-media companies could be fined under the U.K.’s Online Safety Bill, which will soon be finalized, if they don’t stop under-13s from using their platforms. However, the government has reportedly dropped plans to scan encrypted messages for harmful content until doing so becomes “technically feasible.”
IN CASE YOU MISSED IT
Inside the Burning Man ‘mudpocalypse,’ where Silicon Valley CEOs, investors, and billionaires faced off against the powers of nature’s wrath, by Alexandra Sternlicht
Google’s ‘chief decision scientist’ explains why she left the company and why business leaders’ choices about AI are so critical, by Rachyl Jones
Arm is halving its IPO ambitions to $4.87 billion, but it will still be the world’s biggest of 2023, by Bloomberg
Lina Khan’s FTC will likely hit Amazon with an antitrust lawsuit this month that caps a 4-year investigation into its online marketplace, by Associated Press
ChatGPT’s move to lure businesses into the AI waters gets mixed reactions, by Sage Lazzaro
Inflection AI cofounder Mustafa Suleyman: ‘Ban the use of AI in elections—right now’, by Mustafa Suleyman
Europe’s biggest car show was long the stomping ground of German brands—but it’s now ‘become the China show,’ by Christiaan Hetzner
BEFORE YOU GO
Toyota’s full-disk factory shutdown. All of Toyota’s Japanese factories had to shut down on Aug. 29 because of an IT problem. The automaker denied a cyberattack was to blame, and today it pinned the incident on the rather embarrassing consequence of a maintenance procedure.
Apparently, “data that had accumulated in the database was deleted and organized, and an error occurred due to insufficient disk space, causing the system to stop.” Moving the data to a server with more capacity did the trick.
This is the web version of Data Sheet, a daily newsletter on the business of tech. Sign up to get it delivered free to your inbox.
