Surveillance capitalism and your car

  • How your car is keeping tabs on you
  • What 'behavioural surplus' your car is taking from you
  • Why car makers are doing it

Surveillance capitalism and your car

A poll we conducted found 75% of drivers don't want monitoring devices in their cars. Only 10% of people polled knew their car had a data agreement in place. And almost 90% of people would not like their car to share driving habit data with third parties.

Out of the 532 polled over a weekend on our website, the vast majority of people don't like the idea of their cars snooping on them. Yet, with new cars you're constantly prompted to accept terms and conditions in order to use their full suite of services. Editor, Keith Adams, says: 'It's true that we're agreeing to all manner of terms and conditions on a daily basis – I shudder to think what Google knows about me – but it comes as a surprise to see so few drivers are aware of what their cars knows about them. It suggests that carmakers need to make their data gathering more transparent, their agreements easier to read, and most importantly for the 75% of drivers who don't want it, to opt out of.'

So there's a disparity between what people want and what people know about. But should people be worried by what their car knows and shares?

Surveillance capitalism and behavioural surplus

Don't worry, these terms aren't as scary as they sound.

Coiner of both phrases, psychologist Shoshana Zubofff, says surveillance capitalism 'unilaterally claims human experience as free raw material for translation into behavioural data.'

Some of this data is applied to service improvement. While the rest is declared as a behavioural surplus.

Surveillance capitalism translates your data. While behavioural surplus takes some of that and uses it to make predictions about you.

Both of these things happen today in new cars.

The rise of connected services

What your car knows about you

Your behavioral data and how it's used

> What this means for you

> Should you be worried?

What your car shares, according to the manufacturers

The rise of connected services

Google is renowned as the inventor of extracting behavioural surplus. It takes what you put into it and analyses it.

There are vehicle-specific data companies doing this too. For instance, Otonomo - in February 2021 the Israeli company floated on the Nasdaq (an American stock exchange) for $1.4 billion. The company ingests more than four billion data points per day from more than 40 million vehicles. It then interprets this data to create new services.

Automotive manufacturers buy data from Otonomo to create 'new revenue streams by enabling the utilisation of the vast amounts of data vehicles generate on a daily basis.'

Otonomo is a data aggregator and integrates many different data providers and sources to create the most attractive and comprehensive data pool. It measures things such as throttle position, number of passengers, speed, and trip duration.

BMW iDrive 8.0

One car company that works with Otonomo is BMW. BMW UK told Parkers: 'Otonomo is a trusted partner for BMW CarData. This 'personal data' only concerns 'personal vehicle data' and not actual/real personal data.'

This means companies like Otonomo take your data and remove any personal information on you, and package it up for other companies to buy.

How do data companies, Google, and car manufacturers harvest your data?

One of the biggest ways is through connected services. Connected cars are ones that have their own internet connection. Broadly these systems allow drivers to use an app. From this, the user can remotely start the car, tell the climate control to reach a set temperature, and ask it to show you the nearest restaurant.

Car companies are forever releasing newer versions of the latest connected services. There's usually a big new screen in the car, an app, and a load of new digital forms to sign.

Some cars make you sign a user agreement, and then give you a user profile. From this they collect anonymised data from you with your car and your app.

Why would they want to do this? Kia's latest notification centre attached to its UVO Connect system offers customers information on recalls. But according to Kia's Manager of Connected Car Product Planning, Sebastián Salera, it could be used for marketing and finance offers too. Kia is currently 'undecided' about whether it will offer it, but has admitted that it's possible.

Kia's system is clever enough to understand when your finance agreement is up. While it also knows your driving habits. With this, Kia could know what your next car is before you do.

My Audi App

What your car knows about you

Any car with an app most likely knows where you are, the regular routes you take, as well as where it's parked at night.

Apps based on your phone track and measure you in more specific ways than a car can.

During our nine months with a Volvo XC90, Volvo collected data such as diagnostic codes in order to improve the car. At the same time it also processed 'personal data for the customer management' including creating an online and social profile.

Interestingly, Volvo's app-based service does record things like location, but this kind of personal information is removed as soon as you hand the car back. To check this, we requested the data Volvo held on us and it had deleted all specifics.

What does Volvo do with your data? It discloses personal data to companies within the same group of companies and to different business partners. The business partners can be retailers, marketing research companies, research and development partners, social media companies and companies that Volvo makes use of for IT products and services.

So your car can figure out where you are and why. But cars are smart enough to tell if you're too tired to drive, for instance, thanks to facial recognition software.

Subaru's driver monitoring system uses a camera and infrared LED discreetly mounted on top of the central information display on the dashboard and watches your eyes and head movements for signs of distraction or drowsiness.

Subaru driver monitoring system

Less sophisticated measuring devices include the 'black box'. You may have used one for insurance purposes. How fast you drive, the severity of your braking, how high you rev can be used to determine if you're driving safely. From this, insurance companies can determine whether to maintain an insurance policy, vary the cost of a premium or decide whether to pay a claim.

Your behavioral data and how it's used

Writing in a magazine for car dealers just after the 2016 US election, former Cambridge Analytica Chief Risk Officer, Duke Perrucci, said that his analytic methods revealed 'How a customer wants to be sold to, what their personality type is, and which methods of persuasion are most effective.' He added: 'It only takes small improvements in conversion rates for a dealership to see a dramatic shift in revenue.'

Chief economist of Google, Hal Varian, thinks the shift it's not only sales that will change. He said: 'Because transactions are now computer-mediated we can observe behaviour that was previously unobservable and write contacts on it. This enables transactions that were simply not feasible before.

'Nowadays it's a lot easier just to instruct the vehicular monitoring system not to allow the car to be started and to signal the location where it can be picked up.'

My Audi App

In the future car manufacturers look set to roll everything into individual apps. This means your data, your finance agreement and the ability to book servicing will all be in one place, according to Mark Aryaeenia, CEO of vehicle data company, Verex. The company exclusively manages the connected data for 13 car makers in the UK including Jaguar Land Rover, Renault, and Mazda.

He told Parkers: 'Car manufacturers are very much stuck in a product-centric approach, and they want to move away from it.

'They want to bring all different car ownership prospects, including electric charging, into one reference point - a brand's app. This helps manufacturers transition into services too.'

What this means for you

At the present, your car knows a lot about you. But there's little evidence in the way of car manufacturers doing much with that knowledge.

One way car companies are looking to cash in on some knowledge about you is with further add-ons. Some are larger than you'd think.

Skoda offers drivers of cheaper vehicles the ability to upgrade features from inside the car. For instance, Octavia SE customers have the option of upgrading to auto-dip headlights for a one off payment of £179. This includes unlimited access to the feature and is transferable from owner to owner.

BMW in-car upgrade

BMW does something similar. We've experienced this in a BMW 530e. There's a physical button with the corresponding icon for adaptive high beam (where the car notices oncoming traffic and dips the beam for you) on the indicator stalk. After pressing it, the instrument display says 'function acquirable', and a pop-up message adds it's available for purchase - for £160.

Buying from behind the wheel will continue to weasel its way into everyday life thanks to Google.

The Polestar 2 was the first car to have Google's Android OS natively plumbed into it. Polestar's website mentions that thanks to Android Automotive OS being native, the Polestar 2 'will soon be a shop you can buy things in.' Polestar's UK representatives admit that what you will be able to buy largely depends on what Google offers.

Lex Kerssemakers is the head of global commercial operations for Polestar's parent company, Volvo. He said: 'We absolutely will use data to tailor make offers to customers.

'We went through thousands of legal pages to go with Google. Going with Google means we open up potential for other business opportunities. We're exploring different options with Google. How we can leverage that remains to be seen.'

Google did not respond to questions about its continued expansion into cars.

Polestar 2 Google

Mark Aryaeenia told Parkers: 'Car companies are thinking far ahead into the future. For instance, an autonomous car has a captive audience. Imagine the e-commerce opportunities it has.'

Polestar defends sharing data with Google by saying: 'The vehicle data Google has access to in a bid to improve the driving experience would include things like Google Maps needing to know the battery status so it can help plan routes and charging stops.'

Ford is the latest company to partner with Google. From 2023, Ford will offer vehicles with Google Assistant voice control functionality, Google maps, and Google Play store built-in.

Ford reckons the partnership 'will unlock personalised consumer experiences.' A Ford spokesperson added that the system 'allows us to have a more intimate relationship with a customer, because their behaviour in a vehicle will make all our interactions personalised.'

Ford UK told Parkers it's too early to speculate how this might affect UK customers.

Both Ford and Polestar are keen to point out that customers' data will only be shared with Google and not third-party companies.

Should you be worried?

Worried is a strong word. For now, we'd hazard a guess at no. But it really comes down to personal preference. On the one hand, you might think that because most of the data shared is anonymous, there's not much to worry about.

Our own experiences with car manufacturers has shown that data has been anonymised and deleted appropriately.

While on the other hand is the rise of Google and Alexa being plumbed into cars. In some respects, Google owns such a diverse suite of companies that keeping your data in-house still allows for it to translate and sell lots of information about you.

Thanks to the connected car, in the future your digital profile will have even more precise data on you. Once again, whether that bothers you is personal.

What your car shares, according to manufacturers

Ford Mustang Mach-e

BMW Group (BMW, Mini)

'The BMW Group aims to ensure customers always have control and transparency over their vehicle data. The data protection notice can be viewed online at any time. The settings for how much and which data from the vehicle may be shared can be viewed and changes made in the data protection menu in the vehicle and on the ConnectedDrive website.

'The BMW Group shares safety relevant traffic information (SRTI) for everyone for free under Creative Commons licenses since 2019. This means anyone can use that data to improve traffic safety as long they don't make a profit out of it.'


'Customer data is used by Ford in accordance with published policy. In Europe, connected vehicle data, for example location and driver behaviour data, may only be shared with authorised dealers where we have communicated this clearly to our customers and have an appropriate legal basis in place, such as customer consent.

Where we rely on customer consent, the customer has the right to withdraw that consent at any time. We may collect and share vehicle data with our third party service providers to help us provide customers with connected vehicle services, such as real-time traffic service.

Customers can set preferences in the vehicle, to limit the collection of connected vehicle information, through the infotainment system's settings.'


'Honda handles and uses customer information in compliance with privacy regulations as described in our product and app Privacy Notices. Honda does not share data with car data companies.'


'We may share personal data with other organisations if the law or a public authority says we must share the personal data.

However, all the information we share will be collected and anonymised, so neither the customer or the customer's can be identified from it.'

JLR (Jaguar, Land Rover)

'As a business we recognise the importance of strong information governance, particularly when handling vehicle and personal information.

We are trusted by our customers to protect their privacy, and we do so through ensuring robust security and privacy adherence (including General Data Protection Regulation (GDPR) compliance) in all matters concerning customer, partners and employee data. We act responsibly to ensure there is transparency, choice and security when using individual/personal data. We give our customers the choice to access optional products and services.

When in-vehicle and/or over-the-air data access is required, Jaguar Land Rover will use the data transparently and for the use case stated and agreed. We support the strict control of who has access to customer, partner and employee data, and adheres to a legal framework.

Jaguar Land Rover does not support open access to data and believes it is imperative that customers retain an element of choice to their data being shared.'


'Kia collects and processes personal data only insofar as the collection and processing is necessary for the conclusion or the performance of the contract for the provision of the UVO Services or legitimate interests.

If a customer gave us his/her consent, we also process the data, the customer is providing to us based on this consent to improve our products and services.

The data is not sold to external companies.'


'We use data, as all companies do, to target customers with service reminders, warranty info etc provided they have consented and we do not sell that data.

We do not share data with car data companies.'

Mercedes-Benz (Mercedes, Smart)

'We believe that secure and responsible data handling is a prerequisite for the acceptance of connected and fully automated driving. When processing personal data, we observe applicable laws.

With increased vehicle connectivity and technology– we have three clear principles when it comes to data protection.

Transparency: Our customers must be aware of what data is being collected, when, and for what purpose. We provide customers comprehensive information on how their data is used across channels such as - sales information, the operating instructions as well as the terms of use and data protection notices (i.e. for Mercedes me connect).

Self-determination: Our customers decide which services they would like to use and which data they would like to disclose - either by indicating their consent, signing an agreement or 'pushing a button'.

Data security: Our high standards of security also apply to the data security for connected vehicles. Daimler protects customer data from manipulation and misuse. We are constantly developing data security in line with advances in IT.'


'MG does not gather customers' info from either the infotainment system or an app.'


'At Nissan, data privacy is of the utmost importance. Customer data is collected through our connected services applications and limited components are accessible by third-party companies who are responsible for delivering connected services.

They are bound by confidentiality agreements with their sole purpose for access to data being the delivery of connected services.'

Renault (Alpine, Dacia, Renault)

'We gather marketing consents through the MY Renault app but are not currently using any vehicle data for marketing purposes. Information is only shared with suppliers to enable them to deliver their service, for example, Customer Relations, Roadside Assistance, Service and Maintenance

We are fully compliant with GDPR regulations.'

Stellantis (Abarth, Alfa Romeo, Ciroen, DS, Fiat, Jeep, Maserati, Peugeot, Vauxhall) 

'We take the protection of customer data very seriously. Data is managed in full compliance with existing European General Data Protection Regulation and guidelines from national data protection authorities.

None of the data in the infotainment system are reused by the Group. Customer data in vehicle apps is never reused for marketing purposes, unless a specific consent from the customer has been collected.

As a manufacturer, we follow the European Automobile Manufacturers Association (ACEA) recommendations about Extended Vehicle and GDPR.

We take the protection of customer's data very seriously. Data is managed in full compliance with existing European General Data Protection Regulation and guidelines from national data protection authorities.

None of the data in the infotainment system are reused by the Group. Customer data in vehicle apps are never reused for marketing purposes, unless a specific consent from the customer has been collected.

As a manufacturer, we follow the European Automobile Manufacturers Association (ACEA) recommendations about Extended Vehicle and GDPR.'


'We don't have any vehicles with cellular connectivity and we don't have a brand app. There is no such personal data gathered for Suzuki models.'


We collect three main types of information related to you or your use of our products and services:

Information from or about you or your devices
Information from or about your Tesla vehicle
Information from or about your Tesla energy products

To improve our vehicles and services for you, we may collect certain telematics data.

We may share information with:

Our service providers and business partners when necessary to perform services on our or on your behalf
Third parties you authorize
Other third parties as required by law

We may share information with other third parties you authorise.

Toyota (Toyota, Lexus)

Personal data is never extracted from the infotainment systems of our cars. In fact, when sold through our network, a used car would have all stored information deleted.

Data that flows through apps is never used, without prior consent. For example, in relation to marketing.

Data is not sold to external parties.

VW Group (Audi, Bentley, Porsche, SEAT, Skoda, Volkswagen)

'Volkswagen UK is committed to protecting and respecting any personal information you share with us.

We collect information about you and your vehicle when you engage with our website, applications or authorised repairer network. We only collect information which is necessary, relevant and adequate for the purpose you are providing it for.

Any personal information that we obtain from you directly is provided to us on a voluntary basis. However, if you do not give this information to us, you may be unable to receive certain services from us or our partners or communicate with us effectively.'

Volvo (Polestar, Volvo)

'Volvo Cars disclose personal data to companies within the same group of companies as Volvo Cars as well as to different business partners.

The business partners can be retailers, marketing research companies, research and development partners, social media companies and companies that Volvo Cars make use of for IT products and services.'