In a letter addressed to the Federal Trade Commission (FTC), Senators Ron Wyden of Oregon and Edward J. Markey of Massachusetts have called for an investigation into how car companies, particularly General Motors (G.M.), Honda, and Hyundai, handle the data of millions of car owners. The letter, citing previous reporting by The New York Times, reveals the privacy implications of connected cars and the undisclosed tracking of drivers by automakers.

One concerning practice outlined in the letter is the collection and anonymous sharing of car movement data and exact locations by General Motors. If a General Motors vehicle has an internet connection, this information is being collected and shared with a data broker. The senators highlight that many drivers are unaware of such data tracking by automakers.

The Times' previous reporting disclosed that automakers like G.M., Honda, and Hyundai collected data on drivers' behavior, such as abrupt braking, rapid acceleration, and speeding. This data was then sold to the insurance industry to assess individual drivers' risk levels. The senators specifically focused on these three automakers due to their affiliation with Verisk, an analytics company that sells data to insurers.

Surprisingly, the senators' investigation revealed that automakers made relatively little profit from selling driving data. The letter states that Verisk paid Honda $25,920 over four years for information on 97,000 cars, amounting to approximately 26 cents per car. Hyundai received just over $1 million, equivalent to 61 cents per car, over a six-year period. G.M.'s earnings from selling driving behavior data were undisclosed.

Senators Wyden and Markey denounced the practice of selling Americans' data without their consent, particularly criticizing automakers that profit from selling cars for tens of thousands of dollars while additionally monetizing customers' private data.

The senators expressed concern about the methods used for data sharing. While Hyundai automatically enrolled any car with an internet connection in the data sharing program, G.M. and Honda customers were required to opt-in. However, Senator Wyden denounced G.M.'s enrollment process as "deceptive."

The Times' initial reporting in March prompted the cessation of data sharing concerning driver behavior. Verisk closed down its "data exchange" for driving behavior in April. Honda and Hyundai clarified that no identifiable consumer information was shared without customers' consent, emphasizing that data sharing only occurred with customers' opt-in.

While G.M. has stopped selling personally identifying information about driver behavior, the company still shares anonymized location data from their vehicles with an undisclosed entity. G.M. informed Senator Wyden's office that it did not seek customer consent to share vehicle location, and the only way to opt-out was to disable the car's internet connection entirely.

As of now, the FTC has received three letters from Congress regarding the collection of data from Americans' cars. In response to public concern, the FTC solicited reports from consumers on the issue in March, but the agency has not commented on whether an investigation is underway.

The call for an FTC investigation highlights the ongoing debate surrounding consumer privacy and the need for stricter regulations in the auto industry. Privacy advocate and technology journalist, Kashmir Hill, has extensively covered these issues, shedding light on the potential consequences of connected cars.

Kashmir Hill's reporting has brought attention to how technology, including connected cars, can shape and impact people's everyday lives, particularly regarding privacy concerns. With over a decade of experience covering technology, Hill continues to explore the evolving landscape of privacy in the digital age.