"Cars Are the Worst Product Category We Have Ever Reviewed for Privacy" - Report by Mozilla

[Tooney]

https://foundation.mozilla.org/en/p...t-category-we-have-ever-reviewed-for-privacy/

https://foundation.mozilla.org/en/privacynotincluded/volkswagen/

 

[pnw-ev-nerd]

I have absolutely no reason to believe Porsche isn't as bad as VW or Audi.

Fucking disgusting. I'm glad this made news but there still isn't enough outrage.

 

[violuma]

This is obviously extremely provisional, because I don't even have the car yet, but so far I have been impressed with the way Porsche deals with privacy. Another potential difference is that I live in California, and our CCPA law is stronger than most of the rest of the US (on a par with Europe's GDPR).

A few weeks after placing my order and signing up for MyPorsche, I bothered to read through all of their privacy policies and so on, and made the request to opt out of all of their sharing of my private information.

I received an email confirming receipt of my request, another email claiming it had been completed, and pretty much immediately thereafter all of the personalized content on the MyPorsche website (presumably things like "what cars are for sale near you that are close to your desired configuration") was replaced by generic banners saying something like "content not available due to your data privacy settings".

 

[pnw-ev-nerd]

This is obviously extremely provisional, because I don't even have the car yet, but so far I have been impressed with the way Porsche deals with privacy. Another potential difference is that I live in California, and our CCPA law is stronger than most of the rest of the US (on a par with Europe's GDPR).

A few weeks after placing my order and signing up for MyPorsche, I bothered to read through all of their privacy policies and so on, and made the request to opt out of all of their sharing of my private information.

I received an email confirming receipt of my request, another email claiming it had been completed, and pretty much immediately thereafter all of the personalized content on the MyPorsche website (presumably things like "what cars are for sale near you that are close to your desired configuration") was replaced by generic banners saying something like "content not available due to your data privacy settings".

If having to jump through those hoops impresses you, then I implore you to raise your standards for acceptable privacy practices.

They should not be sharing any of this data in the first place. Opt-out is hostile to privacy. I'm glad they have the privacy equivalent of a mail-in rebate, its better than nothing, but to see someone impressed by that is....depressing to me.

Also: what about those of us who don't live in a state with the right to opt out? Porsche doesn't seem to give a shit unless they're forced by law :|

 

[violuma]

If having to jump through those hoops impresses you, then I implore you to raise your standards for acceptable privacy practices.

Given the abysmal state of legal protection for privacy under US federal law, I'm grading on a curve.

 

[pnw-ev-nerd]

Given the abysmal state of legal protection for privacy under US federal law, I'm grading on a curve.

Even still, they're apparently doing the absolute bare minimum.

Demand better.

 

[WasserGKuehlt]

If having to jump through those hoops impresses you, then I implore you to raise your standards for acceptable privacy practices.

They should not be sharing any of this data in the first place. Opt-out is hostile to privacy. I'm glad they have the privacy equivalent of a mail-in rebate, its better than nothing, but to see someone impressed by that is....depressing to me.

Also: what about those of us who don't live in a state with the right to opt out? Porsche doesn't seem to give a shit unless they're forced by law :|

Wait, is checking a box seen as "jumping through hoops"? Ever tried to get rid of Google's or FB's tracking?

When buying a car (or anything), you are opting in to the 'offer' of that merchant. You can definitely opt out/demand better by not purchasing. So long as they're crystal clear with what information is captured and who has access to that information, it's entirely their prerogative to choose a posture towards privacy as they damn please. Let the market sort out the good bets from the ill-advised ones.

I think you should direct your ire at policies governing data collection, protection and disclosure of breaches. IOW, the problem isn't our holding of the bar for VAG/Porsche; it is not holding the bar for the legislators.

 

[pnw-ev-nerd]

When buying a car (or anything), you are opting in to the 'offer' of that merchant. You can definitely opt out/demand better by not purchasing. So long as they're crystal clear with what information is captured and who has access to that information, it's entirely their prerogative to choose a posture towards privacy as they damn please. Let the market sort out the good bets from the ill-advised ones.

The market has already unanimously decided that spying on customers and users for profit is not just acceptable, but a basic expectation for shareholders and stakeholders. "Not purchasing" is not a viable option.

It's as much our prerogative to fight for privacy as it is for a corporation to sell a bunch of fucking wiretaps.


Quit standing up for a corporation. You get absolutely no benefit out of it.

 

[WasserGKuehlt]

They should not be sharing any of this data in the first place. Opt-out is hostile to privacy.
[...]
Also: what about those of us who don't live in a state with the right to opt out? Porsche doesn't seem to give a shit unless they're forced by law :|

@pnw-ev-nerd seeing how my previous response angered you, allow me another attempt:
- I read the articles, and honestly found them a bit tendentious; they were clearly written from the perspective of "privacy is the most important thing ever" (which is personal/subjective), but still felt the need to resort ofto sensationalistic phrasing. That was unnecessary, and it goes against the point of the article. If anything, the detailed list of information gathered by VAG seemed sensible to me - birth, demographic, geolocation, vehicle usage data (speed, warning lights, fuel level etc.), lock/unlock, temperatures, driver behavior (seat belt, speed again), and "interaction with us": these are all legitimate bits of info/telemetry, that anyone else could observe of/about you as a driver on a public road. (The PII data is not, but you do enter a contract when purchasing a new vehicle, and can't do that anonymously.)

- I'm not against privacy, and I'm not "standing up for a corporation", either. In fact, I work on security - protecting our customers from attackers, as well as protecting my company's services/infrastructure from hostile customers. It is difficult, often unrewarding thankless work - everyone expects security and privacy, and very few are willing to pay for it. And features always erode security. I'm saying this because protecting that data is a cost/loss, and not capturing 'telemetry' is a disadvantage for service providers. That is, some companies invest in data protection voluntarily for strategic reasons - but if you truly want protection as a customer, it must be driven by compliance with the law. This is why I said your ire is misdirected - if VAG doesn't already have a policy for consumer data protection, do you think a "petition" to board will get them to spend 10s of millions out of .. what, decency? Or they'll stop collecting the telemetry?

- the previous points addressed the data collection aspect; the other one is the sharing/authorized access. This is trickier, and far more nebulous of a topic, much more difficult to regulate. At most you can demand proof that the right controls are in place, and audit someone often to keep them honest. (This is the bit where the 'features erode security', and really, about the only thing that works is public shaming/exposure, or restricting data movement a la EUDB.)

It's as much our prerogative to fight for privacy as it is for a corporation to sell a bunch of fucking wiretaps.

Absolutely, fight with all your might. I merely said you might have better success taking the legal/legislature path - but I'm rooting for you either way. It's not my fight, though, and I hope it doesn't offend you that I don't strive for "better standards". I'm of the mindset that privacy is a privilege you relegate the moment you venture out in public. That is, it's on me to ensure privacy on aspects that matters to me, I don't expect it of anyone else. I just wouldn't trust them.

 

[violuma]

I'm of the mindset that privacy is a privilege you relegate the moment you venture out in public. That is, it's on me to ensure privacy on aspects that matters to me, I don't expect it of anyone else. I just wouldn't trust them.

I kept the last couple of sentences because I get the impression that they cast your first one as being more in the realm of practicality than ethical philosophy. If that is indeed true, then everybody can probably stop reading now.

With an ethical philosopher hat on, though, I disagree with the first sentence, because of an imbalance of power that is sort of inherent in a capitalist system: entities attempting to profit off of trafficking in personal information are going to be, on average, better funded than individuals whose personal information is being tracked.

So, to me, government has an ethical responsibility to jump on our (customers) side of the teeter-totter and balance things out a bit, by lending us its force to make companies acknowledge in a legal framework that we own our information, and we have recourse if they use it in ways with which we do not agree.

Privacy is a right in my book. I stand squarely with Brandeis's essay about "the right to be let alone". I cannot agree with a characterization of it as a privilege.

 

[WasserGKuehlt]

I kept the last couple of sentences because I get the impression that they cast your first one as being more in the realm of practicality than ethical philosophy.

It's a bit of both - and well spotted.

With an ethical philosopher hat on, though, I disagree with the first sentence, because of an imbalance of power that is sort of inherent in a capitalist system: entities attempting to profit off of trafficking in personal information are going to be, on average, better funded than individuals whose personal information is being tracked.

So, to me, government has an ethical responsibility to jump on our (customers) side of the teeter-totter and balance things out a bit, by lending us its force to make companies acknowledge in a legal framework that we own our information, and we have recourse if they use it in ways with which we do not agree.

True, but:
- turns out sometimes the gov't itself wants some of that data. And then it becomes difficult to justify to citizens (at least in a reasonably democratic society) why it's ok for them to collect that data, but not ok for private parties (such as companies), and so the gov't itself is relinquishing its moral responsibility - out of convenience. (So we're back to the realm of practicality.)
- the defense (as provided by the legal framework) still needs to be realistic, or somehow match reality in its intensity and reach. I think most humans would be able to say what's "reasonable" for someone else to observe/collect/store about them or their interactions. I.e. you wouldn't expect not to be filmed walking up to a bank counter/private property door; you also wouldn't expect to see that projected in, say, Times Square. (Although technically speaking, these could be the same information/disclosure 'score'.) Trying to capture what is 'reasonable' is where we get into the weeds, because those better funded entities will fight for the most relaxed phrasing of the law. This is where I'm more on the "put your government to work" camp, I don't expect that there is an intent of the law, and the lawmakers will keep it current/actualized.

Privacy is a right in my book. I stand squarely with Brandeis's essay about "the right to be let alone". I cannot agree with a characterization of it as a privilege.

I need to tread carefully, as I value what's left of my privacy ? - let's just say I wasn't born around here. Over 'there', the state actively spied on its citizens and so the concept of 'privacy' is very much a privilege to me. I've been fortunate to be able to gain it, and also to have a decent understanding of what it is (conceptually), what's under my control and what I'm risking when I de-cloak, so to speak. For whatever is worth, I've taught my kids they have a right to privacy and their secrets, as the basis of trust. At times, that was detrimental to typical parenting practices ("why can't you show me your grades?" "because privacy"), but I'm still not certain it's really a right in as broadly of a sense as most understand it. You can't make someone not observe you outside of your private 'zone'.

 

[violuma]

- turns out sometimes the gov't itself wants some of that data

I guess my response to this would depend on what sorts of things gov't is planning to do with the data and what sort of data it is.

why it's ok for them to collect that data, but not ok for private parties (such as companies)

In general terms, my default response would be "because the government's use of the data will be bound by regulations designed to protect/maximize some sort of public benefit, whereas companies are not so bound".

I think most humans would be able to say what's "reasonable" for someone else to observe/collect/store about them or their interactions.

I agree with you, but I think it's a lousy way of looking at privacy. I prefer to flip the burden of proof around (as GDPR et al do) and permit a right of action if companies fail to secure consent.

let's just say I wasn't born around here.

Yeah, the username sort of gave you away there, unless it's a movie character I'm unfamiliar with.

Over 'there', the state actively spied on its citizens and so the concept of 'privacy' is very much a privilege to me. [...] I'm still not certain it's really a right in as broadly of a sense as most understand it.

If you haven't read the essay I was referring to, I think you might be interested in it. I find it especially impressive given that it was written in 1890, long before anybody had heard of Hitler or Stalin.

https://www.cs.cornell.edu/~shmat/courses/cs5436/warren-brandeis.pdf

 

[WasserGKuehlt]

In general terms, my default response would be "because the government's use of the data will be bound by regulations designed to protect/maximize some sort of public benefit, whereas companies are not so bound".

I should have taken an example. As discussed earlier, we can tackle the problem at the 'collection' phase (what can govt/companies capture), or the 'sharing' one (who has access). Ideally we'd limit the collection, and that set of rules would apply equally to all entities - no need for differentiation. Controlling the sharing, as mentioned above, is far more difficult (case in point: training bots with user content/data) and while it's fair and reasonable for us to tell the gov't "share with no one", it's not as fair to impose that on a company.
Example A: a Chevy buyer is a GM customer, and maybe Cadillac wants to upsale them. You may like it or not, but it's a reasonable, legitimate case - it's the same corporation/have a business relationship.
Example B: a FaceGram user has their data shared to Creepy Analytica, for a small monetary consideration. This is an outrageous, farcical "business relationship", and while I detest it, I can't think of a way we'd capture that in law.

Yeah, the username sort of gave you away there, unless it's a movie character I'm unfamiliar with.

Nah, it's just a half-clever nom de plume, born of my fondness of the 996 (or rather, of my antipathy towards the air-cooled snobs); still, it was the same curtain.

Thanks for the recommendation.

 

[violuma]

it's just a half-clever nom de plume, born of my fondness of the 996 (or rather, of my antipathy towards the air-cooled snobs)

*facepalm*...as I totally out myself as having less than zero domain knowledge on things Porsche until four months ago.

Note to self: read people's handles out loud at least three times before you come to a conclusion as to what they signify.

 

[Tooney]

reason on X: "Is your car spying on you? Here’s how to check. https://t.co/Cam1dr1t1F" / X (twitter.com)