Connected Cars: New Report Warns of Major Privacy and Security Risks

The Privacy Risks of Connected Vehicles

The CEST report identifies 12 major privacy risks associated with modern automobiles, spanning cybersecurity vulnerabilities, precise geolocation tracking, and consumer insurance practices. Luc Bégin, president of the CEST, noted that today’s cars are essentially computers on wheels. This assessment echoes findings from the Mozilla Foundation, which concluded in 2023 that modern connected vehicles represent the worst product category it has ever evaluated for privacy protection.

Data collection extends beyond the vehicle’s occupants. According to Bégin, vehicle cameras routinely capture footage of pedestrians and passengers who have no idea they are being filmed. Furthermore, only about 7 % of consumers actually read vehicle terms and conditions, which researchers found to be excessively long, vague, and difficult to comprehend. The CEST report concludes that the traditional model of individual consumer consent is entirely ineffective within the connected vehicle ecosystem.

Data Security Flaws and Third-Party Storage

Automakers typically store the massive amounts of data collected by vehicles on external servers managed by third-party providers. The CEST report warns that every single transfer and storage point creates a potential target for hackers, compounded by a distinct lack of transparency regarding data protection standards. Bégin emphasized that these vulnerabilities could eventually trigger national security concerns.

Real-world incidents already highlight these digital vulnerabilities. In 2024, a massive data leak traced to Amazon Web Services (AWS) servers exposed information belonging to approximately 800 000 electric vehicles from the Volkswagen group over the course of several months. Beyond corporate hacks, location data harvested by cars poses severe risks in cases of domestic violence and coercive control, where tracking technology can compromise the safety and confidentiality of locations like shelters for abused persons.

Unfair Insurance Algorithms and Surveillance

Driver-monitoring insurance programs, often marketed as safe-driver discounts, face sharp criticism in the CEST report for generating unfair outcomes. Algorithms frequently penalize individuals who drive at night or travel through specific neighborhoods, driving up premium costs for low-income workers. Because insurance companies do not disclose how they calculate these driver scores, consumers have no meaningful way to contest a bad rating.

At the same time, vehicle data is increasingly crossing over into criminal proceedings. Earlier in the month, prosecutors in upstate New York used vehicle telemetry data to secure the conviction of Luciano Frattolin for the murder of his daughter, who lived in Montreal. Bégin acknowledges that connected features offer genuine public benefits, such as real-time accident alerts and automated mechanical diagnostics, but stresses that society must carefully balance these advantages against the rising threat of pervasive surveillance.