Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

101–110 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#101

Post by plagiarist »

short_sells_poo wrote: post #36
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

> Interior images, exterior images, facial geometry, voice recordings, This is an absolutely unbelievable level of privacy intrusion IMO. I 100% support very heavily fining this sort of behavior, otherwise it will continue to proliferate.

We need stronger laws about protecting user data. Like HIPAA but for everything. Storing millions of hours of video of people driving and their GPS should be a liability. I did not consent to any of this, but I'm certainly on recordings for drivers who did, that should also be an enormous fine.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#102

Post by dybber »

jeffbee wrote: post #63
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

All car shrink-wrap licenses that I have looked at are similar. That's why I think it is funny when people freak out about Android Automotive. The Android Automotive terms are much, much better for customer privacy. The EULA for my Honda says that Honda can and will share all available data with itself and third parties, named and unnamed, for any or no reason.

How does these EULA’s work if you buy a used car? I suppose manufacturer doesn’t really know if the car has been sold and the new owners haven’t accepted the terms?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#103

Post by nobaddays »

LeifCarrotson wrote: post #30
malikNF wrote: post #19

I hope regulators fine the hell out of these companies. Enough to make them think twice about offering these upload everything to the cloud services no one really asks for.

It's a simple equation: Revenue = (value of data per person) x (number of customers) - (probably of data loss) x (probability of fine) x (cost of fine). If that number is greater than zero, they'll do it, if it's less than zero, they won't.

This is from fight club lol

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#104

Post by at-fates-hands »

I have a 2014 model but the exposed data was between November 14, 2016, and April 4, 2023.

I wonder how long they hold onto the data before erasing it or if they hold onto to it indefinitely. I don't remember seeing specifics in the EULA about the length of time they hold your data - only that they can and will sell it to 3rd parties.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#105

Post by vkou »

jackmott42 wrote: post #77
skrtskrt wrote: post #8

Earlier quoted context omitted.

Toyota's hybrid tech is and has been the best and most reliable for a very long time. I think it's a shame that the EV regulations and incentives (at least in America) are not as friendly for traditional hybrids and plug-in hybrids. They have basically zero downsides compared to full ICE or full EV, and would still make a massive dent in emissions. PHEVs in particular - most people are going under 100 miles a day, so…

Hybrid vehicles are the most likely to catch fire.

Is the likelyhood of my vehicle, be it ICE, Hybrid, or EV catching fire higher or lower than me getting struck by lightning, or getting eaten by a shark/bear/goat?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#106

Post by megous »

lmkg wrote: post #91
SR2Z wrote: post #72

Earlier quoted context omitted.

Yeah, companies seem to think that "personally identifiable information" is basically just your name. That's clearly wrong because GPS data and VIN make it extremely straightforward to figure out who a car owner is. As far as I'm concerned, this is PII. That statement is a bald-faced lie and a state AG should bring charges over this - it's extraordinarily irresponsible for Toyota to collect this data and then leak it…

"Personally identifiable information" is a legal term with a legal definition[1], and location data is not PII. Companies think that PII is basically just your name because that's literally true: PII means name and government-issued ID number. That's it. Everything else is not PII. Relatedly, PII sucks as a basis for privacy law. The laws enshrining PII were made in response to identity theft[2], and that's the "thre…

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

GDPR accepts that person can potentially be identified with reference to location data.

Anyway, "Personally identifiable information" is a weird term. Person can be identifiable in various ways. Information is just information. GDPR doesn't use this term.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#107

Post by sandworm101 »

dybber wrote: post #102
jeffbee wrote: post #63

Earlier quoted context omitted.

All car shrink-wrap licenses that I have looked at are similar. That's why I think it is funny when people freak out about Android Automotive. The Android Automotive terms are much, much better for customer privacy. The EULA for my Honda says that Honda can and will share all available data with itself and third parties, named and unnamed, for any or no reason.

How does these EULA’s work if you buy a used car? I suppose manufacturer doesn’t really know if the car has been sold and the new owners haven’t accepted the terms?

Well, how do the shrink-wrapped EULA's work when you sell a computer? What is Microsoft's position on you selling your windows license to a third party? I expect that car manufacturers will eventually take a similar line. But it won't be a big deal for very long. As we will soon all be paying subscriptions to use our cars, license transfers will be balled up into the transfer fees paid when you move your ongoing subscription commitment to the person buying your physical car. The manufacturers will supervise the process.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#108

Post by spieglt »

beefee wrote: post #62

Owners may want to disable this in hardware rather than relying on a sketchy opt-out mechanism. The relevant part is the "data communications module". It has an LTE modem and a backup battery, so it's able to transmit even if the car battery is disconnected. It requires a little bit of dashboard disassembly to access. You can either remove it or disconnect the LTE and GPS antennas. Toyota has technical documents avai…

I removed the DCM from my RAV4. The annoying part is that it disables the front-right speaker.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#109

Post by jacquesm »

Cardinal7167 wrote: post #57
short_sells_poo wrote: post #36

Earlier quoted context omitted.

> Interior images, exterior images, facial geometry, voice recordings, This is an absolutely unbelievable level of privacy intrusion IMO. I 100% support very heavily fining this sort of behavior, otherwise it will continue to proliferate.

It will never get fined because it’s how the people who legislate fines are making (and keeping) their money and control.

EU DPA's may have something to say about this if EU data subjects data was leaked.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#110

Post by version_five »

short_sells_poo wrote: post #36
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

> Interior images, exterior images, facial geometry, voice recordings, This is an absolutely unbelievable level of privacy intrusion IMO. I 100% support very heavily fining this sort of behavior, otherwise it will continue to proliferate.

Where would the support for fines come from? When government understands these issues at all, they only want more control and restriction. The only thing I can imagine legislators getting upset about is they the car manufacturers are not sharing all the info with government by default. Next steps will be mandating tracking, not fining for it.
Post reply on HN