Tesla tops Mozilla's list of 'creepiest' carmakers, but 25 brands failed basic data privacy tests

The non-profit Mozilla Foundation deemed cars the "worst product category" ever reviewed for data privacy, according to research released Wednesday. Its Privacy Not Included Research division reviews everything from smart home devices to health and wellness apps. But of the 25 car brands the research team studied, not a single one passed the reviews, with top brands like Tesla, Nissan and Hyundai landing at the top of the worst-of-the-worst list. 

Tesla earned a mark against it for untrustworthy use of AI, making it the second product reviewed by Mozilla to fail every privacy test conducted. That's because its AI-powered autopilot feature caused several deaths and hundreds of crashes. Meanwhile, companies like Nissan and Kia say they can collect information about your sexual activity and sex life, and Hyundai promises to comply with “lawful requests, whether formal or informal" to share your information with government and law enforcement. 

That left Renault, Dacia and BMW as the "least creepy" car options. Researchers couldn't confirm whether Renault, which also owns Dacia, encrypts the data it collects, and it doesn't go much beyond what's required by data privacy law, but compared to others it's not the worst. The reason for BMW landing higher on the list was also marginal, as researchers based it on the fact that the car maker doesn't explicitly say they sell data to third parties for advertising purposes, while other manufacturers explicitly claim to do so. "From our reading of BMW's privacy policy, they might not do this. But we're also not 100% sure they don't," the researchers wrote. 

Still, every brand of car collected too much personal data, and most of them share or sell that information to a third party. The researchers spent 600 hours analyzing privacy policies, investigating app features and working directly with the car companies themselves to determine privacy rankings, but still concluded it was one of the more confusing categories they've tested. 

"Sorting through the large and confusing ecosystem of privacy policies for cars, car apps, car connected services, and more isn’t something most people have the time or experience to do," members of Mozilla's Privacy Not Included team wrote in a blog post. That leaves little for car buyers to do if they're looking for an option that takes data privacy seriously because, at least according to Mozilla, they really are all that bad. 

"Unfortunately, consumers have very little control. You can choose to not use a car app or try not to use connected services, but that might mean your car doesn’t work properly — or at all," Jen Caltrider, director of Privacy Not Included, said. "Consumers have almost zero control and options in regard to privacy, other than simply buying an older model. Regulators and policy makers are behind on this front."