Quebec Report Identifies 12 Privacy Risks in Connected Vehicles
Quebec's ethics commission published a report identifying 12 major privacy risks in connected vehicles, including biased insurance algorithms that penalize night drivers and low-income shift workers, unfair scoring practices, and potential use of location tracking in domestic abuse situations. The report also cited a 2024 security failure that exposed data from 800,000 Volkswagen vehicles through an unsecured cloud database.
What happened
Quebec's commission on ethics in science and technology published a 64-page report identifying 12 major privacy risks in connected vehicles, which function as complex digital hubs collecting data through sensors, cameras and microphones.
The report noted that computer algorithms in insurance programs often penalize drivers who travel at night or through specific neighbourhoods, raising insurance rates for low-income shift workers, while insurance companies do not disclose their scoring methods, preventing consumers from disputing poor scores.
Reported impact
Location data collected by vehicles poses risks for domestic violence and coercive control, as abusers can use car location apps to secretly track and control their partners.
A 2024 security failure exposed GPS history and sensitive information of roughly 800,000 Volkswagen electric vehicles through an unsecured Amazon Web Services cloud database.
Index analysis
The report noted that each point of data transfer and storage is a potential target for hackers, with lack of transparency on how data is protected, and cited the Mozilla Foundation's 2023 conclusion that vehicles are the worst category of products evaluated in terms of privacy.
Only about 7 per cent of consumers read the terms and conditions governing data collection, which are excessively long, vague and difficult to read, leading the report to conclude that the classic model of individual consent is fundamentally broken in the connected vehicle ecosystem.
Governance controls
The report identified cybersecurity and data protection challenges but did not specify regulatory controls currently in place to address the identified risks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.