Comment by GJim
7 hours ago
Needless to say, cars in the UK/EU have no such privacy invading features without an explicit opt-in thanks to sensible data protection legislation; including the GDPR.
The FUD spouted on here by the scummy adtech industry about legislation to protect YOUR privacy is mind boggling. These are the people doing the digital equivalent of sniffing your underwear to work out what you had for breakfast.
(And before somebody shouts FUD about the UK/EU vehicle eCall 112 system, that certainly doesn't track you or seek to invade your privacy on any level!)
>cars in the UK/EU have no such privacy invading features If you say so.
Maybe if you buy the car with cash, but if you finance it you are leasing from a company that has definetly accepted all the terms and conditions to capture and sell all the telemetry to various parties
>without an explicit opt-in
check out at a modern volvo/audi/whatever, they are making it so difficult to say no every single time the screen is powered on
> if you finance it you are leasing from a company that has definetly accepted all the terms and conditions to capture and sell all the telemetry to various parties
No it isn't. Stop spreading FUD.
It is illegal in the UK/EU to make provision of a service dependent on allowing your personal data to be sold to third parties. This is BASIC data protection law here. You should be embarrassed for not understanding this.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
> modern volvo/audi/whatever, they are making it so difficult to say no every single time the screen is powered on
More FUD.
The nagware is for "safety" features such as lane assist which must turn on every time by default (yes, this is a PITA). This has nothing whatsoever to do with data privacy requests.
I'm in europe and I work with cars, pal.
nagware is absolutely not for safety features. Deny the terms and conditions and every time you start the car you have at least three screens you have to scroll and click buttons. It is a very recent feature, have seen it on models from january onwards.
BTW: You also want to deny that because if you agree you also agree to update the system at their will (many cases on the press of them fucking it up, bricking cars requiring ECU replacement. A couple of manufactures i won't mention fucked that up as badly as using two different ECU makes for the same car model, and sending the wrong binary and the bootloader happily accepting it. All without user approving the update beforehand. All happening in the background. Car stops at the sign, ECU reboots and dies.)
You also have constant nagware when you disable the tracking features in software.
3 replies →
Sure, and Volkswagen’s diesel cars are totally clean and pass emissions tests as written.
Your trust in the law (EU law! Haha) to do the enforcing itself is nice, but history and lived experience tell me that these laws are going to be skirted if there’s money in it.
3 replies →
> It is illegal in the UK/EU to make provision of a service dependent on allowing your personal data to be sold to third parties.
Nobody seems to care and this isn't enforced at all.
It is very hard to live in Germany without having a google account. Many services are only offered via phone-app that is only available through play-store. I'd have to use apks from questionable, untrusted third-party websites.
Good luck finding an employer that doesn't require you to have a microsoft account.
The EU is not the privacy paradise some make it seem to be. It's a corrupt, bureaucratic, exploitive nightmare with some splashes of democracy here and there.
Von der Leyen is the perfectly ridiculous representative, she left nothing but corruption, collusion and incompetence in her wake.
1 reply →
Replying to my own comment to inform the reader that the fluctuation in moderation points I'm seeing is frankly, extreme! It looks like my parent comment has really touched a nerve here on HN: Privacy supporters Vs Adtech supporters, or maybe those who believe in rule of law, and those who think they can do what they like with others private data.
In addition to the eCall system, note there is also the mandatory OBFCM (On-board Fuel and/or Energy Consumption Monitoring Device), that data is then downloaded from the vehicles using OBD during checks.
The data is anonymized and you can opt out, but many people probably don't know it's collected in the first place.
> (And before somebody shouts FUD about the UK/EU vehicle eCall 112 system, that certainly doesn't track you or seek to invade your privacy on any level!)
How do you know?
BTW, the checking all the opt-ins is usually the first thing the sales person does when selling a new car.
> How do you know?
And the FUD has started. Maybe try reading the law?
https://europa.eu/youreurope/citizens/travel/security-and-em...
I did read the law. Did you? The actual eCall specs are not in there. They are in EN 16102:2011 which is not free, I don't have it, I won't pay for it, and probably you won't either.
But based on my experiece:
- GPS cold start requires 1-2 minutes to get a fix. That's too long in case of a crash. That means GPS is started at the same time as the car.
- A-GPS is better, but not sufficiently fast in case of a crash either.
- The cheapest way to implement an eCall module is to use a phone chip that includes both phone and GPS functions. I'm sure we can agree that all manufacturers will choose the cheapest. That means the telephony is started at the same time as GPS - when the car is started.
- Let's assume that telephony chip is separated. A phone boots in ... 30s? Too slow even if the eCall module doesn't include a full OS.
- A phone in airplane mode still takes 5-10 seconds to connect to the network and 3-5 seconds to dial. If you press the ecall button on your car, how fast does the call connect? If it's less than 5s, the ecall module was already registered on the network. If it's registered on the network, the car leaves a metadata trail on at least one of the local phone operators' servers. That metadata includes the time and the cell towers = full tracking data.
- GSM networks since the beginning mandate that the SIM card can execute commands received from the network. A SIM card is a full independent embedded processor. You should really watch the Defcon and BackHat presentations about SIM cards. Anyone that can send binary SMSs (and most operators are very ignorant/permissive) can track it, start calls, listen on the mic, etc.
- All telephony chips today support packet data. If the car manufacturer wants to, it can preinstall tracking software.
Because no company has ever broken the law before
4 replies →
> Needless to say, cars in the UK/EU have no such privacy invading features without an explicit opt-in thanks to sensible data protection legislation; including the GDPR.
Automotive EE here... You are completely wrong and your rationale is based on misunderstandings of the laws.
I have absolutely no idea how the laws work either, we’re the same. But, I promise you every single car in the EU with GPS and cell is reporting telemetry. Every and all.
I'm tempted to say "oh you sweet summer child", because it seems just unbelievable that the statement is true (in the sense that the small print in rental cars and sales contracts doesn't allow it, ot it's done by law enforcement agencies surrepticiously).
But maybe it IS true. I know it's legally mandated.
> it seems just unbelievable that the statement is true
So do you think UK/EU vehicle manufactures are deliberately in mass breach of data privacy law... fully knowing the cost of a consumer backlash, fines and vehicle recall costs to fix any law breach?
Really?
It's genuinely amazing how many Americans on here (a tech news site!) are unaware of data privacy law and expectations outside their homeland.
> So do you think UK/EU vehicle manufactures are deliberately in mass breach of data privacy law... fully knowing the cost of a consumer backlash, fines and vehicle recall costs to fix any law breach?
They were also in mass breach of vehicle emission laws. The fact that there was some backlash (although people didn't really stop buying VAG cars), people got prosecuted, the company got fined, didn't really change their decisions while they were pumping out fraudulent cars.
Yes, we should have privacy laws like this in the EU, this is a good thing! But thinking that, when these laws are in place, all companies magically will follow them is naive. To them it's still a cost/benefit analysis, and history has shown short term benefit trumps many other things for these companies.
3 replies →
I really do think there is a good chance that say MI5 or the BND or the DGSE flagrantly ignore the law to catch non-national evildoers, just as much as in the US. The temptation to do this 'in the name of security' is very high.
Of course, I can't or won't prove it.
And yes, I am _intimately_ familiar with the GDPR and other laws and regulations. The US also had (has) wiretapping laws that would have prevented snooping on Americans.
I'm not claiming the EU is no better than the US, it clearly has better intentions. But fundamentally, I think the EU will end up in the same place as the US sooner or later, simply because the same forces are at play: desire for security >> desire for privacy for most people if the rubber hits the road.
Here's some fun read for those who seek more info:
https://www.politico.eu/article/germany-privacy-watchdog-sid... https://www.bnd.bund.de/EN/Service/PrivacyPolicy/privacypoli... https://www.lexxion.eu/?newsletters_method=newsletter&id=477
Yes.
Or, more succinctly - they are likely following the law but have figured out a way to avoid it as written using consumer opt-in and dark patterns.
You call it FUD, but this is hacker news and with overwhelming incentives it is not unreasonable to ask for verification that data isn’t being exfiltrated.