Reduce Your Risk of Vehicle Data Breaches: Tips to Keep Your Information Safe
Personal information is harder than ever to protect, and much of it is stored in vehicles themselves. So, how can you protect your company and fleet users’ data?
Andrea Amico, founder and CEO at Privacy4Cars, is passionate about privacy and security, and is chock full of stats and facts on how far-reaching data sharing has become and how many companies have access to personal information. Vehicles themselves collect and store more information than most of us would ever realize, and there is growing history of breaches, warnings, lawsuits, and even settlements. Amico presented all of this in a session at March’s 2022 NAFA Institute & Expo, startling attendees with more than just his blue hair.
Amico first engaged the crowd by handing out USB filters that allow a cell phone to charge without its data being retrieved. The point was to warn attendees to never use other USB sticks, especially given by vendors, “because it’s how bad guys do things.”
Ad Loading...
Then, Amico provided some basic definitions: Security in this case is defined as preventing unauthorized people or companies from having access to personal data, and privacy is the right to have data in the first place.
Chances are you don’t really know how your car works, he said. Car collect data locally (and that data is not stored in a database that has traditional security and privacy) and increasingly they send data out. Consequently, just like with laptops, securing vehicle data must start from protecting the data that is on them... but the more connected they are, the more complex the issue becomes.
Andrea Amico of Privacy4Cars shares some scary and surprising information about just how much data retrived from cell phones connected to vehicles is shared. Here, Amico presents at the 2022 Government Fleet Expo. He delivered a similar presentation to NAFA I&E attendees in March.
Photo: Ross Stewart Photography
When you plug your phone into a car, whether to pair it or charge it via a USB, lots of information from that phone is collected. This can include:
Biometric IDs.
Passwords.
Contacts.
Call logs.
Text messages.
Calendar events.
Downloaded files.
Medical providers.
Navigation history.
Home address.
Garage codes.
Health and credit information.
Third-party apps.
Companies and individuals can buy this data for a steal, too. Amico said the current market price is somewhere between $10 and $60 per person per year.
While most drivers only see directions on their GPS navigation in the car, that geolocation goes much further than the vehicle's infotainment or the manufacturer. It is also shared with firmware providers, component manufacturers, telecom providers, other connected devices, traffic services, weather services, insurance companies, Google, Apple, and more.
“There's a lot of things in which America leads in, but privacy is not one of those things,” Amico said, referencing Europe’s General Data Protection Regulation (GDPR), known as the toughest privacy and security law in the world.
Ad Loading...
In the U.S., without a federal privacy law, data regulation is left up to states. And all 50 states do regulate the personal information collected by vehicles, but not all laws are equal. California, Colorado, Virginia, and Utah, have privacy laws modeled after Europe’s GDPR; while California adds on IoT security laws; and Illinois, Florida, California, Washington, as well as some cities, have biometrics laws. New Jersey was the first state to pass a bill about vehicle telematics and driver monitoring, where companies must tell employees they’re being tracked. If they don't, the company is actually liable.
Biometrics laws, in particular, are under scrutiny, and several companies are facing several lawsuits for violations. In an example, Amico offers this: “You drive a Tesla, it has a camera facing you, it is actually recognizing you, but plaintiff attorneys increasingly are arguing that it is not asking for your consent. In Illinois, for instance, the statutory damages for biometrics violations are $500 a person, so a smart attorney has run the tab and they figure out it's probably worthwhile suing Tesla.”
To help understand the statutes that apply to your state, Privacy4Cars offers a free online resource.
While many companies will issue statements about their ethics, anonymization of data, compliance with GDPR or CCPA, Amico advises digging deeper.
Ad Loading...
What to Read or Ask OEM & Telematics Providers
Privacy policies and terms of service.
Contract and clauses on consent, use, sharing and retention of data.
If they claim geolocation data is anonymized (if so, it’s a red flag as that is hardly possible).
Documentation of compliance with California’s IoT law (even if you’re not in California).
Take the Privacy4Cars fleet risk assessment (below).
Privacy4Cars Fleet Risk Assessment
To take this fleet risk assessment, score each row and total the sum of all rows to find your risk level.
Source: Privacy4Cars
There are steps you can take to protect your data. In 2018, the FTC actually advised fleets to dump the data stored in cars in a message called “Be discreet when you delete your fleet.”
Amico recommends connecting with fleet management companies (FMCs), many of which offer in-vehicle data deletion at the time of sale — Element, Wheels Donlen, and Holman all do, he said.
Actions to Take to Reduce Risk
Read all privacy and service policies.
Ask your FMC what solutions they have in place to help.
Engage legal.
Perform CISO/compliance checks.
Delete all in-vehicle data at handoffs and sale.
Perform a data privacy assessment.
Get vehicles under the same policy policies as other devices (laptops, phones).
Prune! What data do you really need?
Implement robust consent management.
Demand a telematics “kill switch” for off-work hours.
To the last point in the list above, Amico elaborates that in Europe, employees — and any family members — who use a work vehicle for personal use after hours cannot be tracked. California has plans to adopt this rule starting in January, and more states will likely follow suit. Until then, Amico recommends asking your telematics provider how to turn off tracking between shifts.
Ad Loading...
Additionally, consider adding to your fleet policy a clause about shared vehicles and rentals that requires data deletion at handoff.
“As a business, to protect your employees, you need to start protecting yourself,” Amico said.
AI is no longer a future concept for fleets—it’s already embedded in the tools, data, and decisions that operators rely on every day. In this episode of the Fleet Forward Podcast, recorded live at Fleet Forward, industry leaders take the conversation beyond hype to examine what responsible AI adoption really looks like in fleet operations.
As fleets rethink how they capture, manage, and act on vehicle data, telematics is at a major inflection point. In this episode of the Fleet Forward Podcast, we dive deep into one of the most pressing questions facing fleet leaders today: Should you rely on OEM factory-installed connectivity, aftermarket devices, or a hybrid of both?
Experts from telematics analytics, fleet-as-a-service operations, and national EV benchmarking share how real-time data is reshaping fleet strategy—dispelling assumptions, validating best practices, and exposing costly missteps.
A powerhouse panel featuring experts from the American Automotive Leasing Association, CalSTART, and municipal fleet leadership dives into the realities of navigating shifting emissions rules, regulatory waivers, federal agency actions, the future of the EPA’s endangerment finding, and the push for unified standards. They also examine the impacts of tariffs, autonomous vehicle policy, battery innovation, and the accelerating global EV market.
This episode kicks off with a deep dive into the technologies and market forces reshaping today’s fleet landscape. Host Chris Brown is joined by Laolu Adeola (Leke Services), Tyson Jomini (J.D. Power), and Richard Hall (ZappiRide) to break down real-world data, shifting incentives, and practical strategies fleet leaders can use right now.
In the middle of natural disasters fleet managers must shift priorities to protect people and assets. What policy items should be loosened, and when should the line be held?
In this episode, fleet leaders from municipal, university, and private-sector organizations share a candid EV reality check. From infrastructure setbacks and policy whiplash to grant funding, total cost of ownership, and charging resiliency, this conversation dives into what it actually takes to scale electrification in the real world.
After a decade of lagging compensation, fleet manager pay is climbing. But expanding responsibilities, larger fleets, and growing complexity continue to redefine the role.
