Ford Really Wants Your Driving Data

[DustyShades]

I appreciate your focus on evidence.

Let's be slightly more precise - the evidence is about the past, not about now.

That data point gives us evidence they *didn't* sell *MachE* driving data.

It does *not* give evidence about their current actions.

Nor does it give evidence about other car models.

Nor does it give evidence about other time periods.

Ford may have done it in the past, or may do it on other models, or some combination.

Totally agree which is why I said we still don’t know. It’s just a good indicator that they likely don’t

Sponsored

 

[bbulkow]

IDK, y’all better sell your Mach-E because there’s a greater than 0.1% chance Ford might possibly sell a few bytes of data to a 3rd party sometime in the next decade. Even though there’s zero evidence of that happening, you can’t be too safe. I mean, what if someone found out I drove my car a couple miles to the grocery store last Tuesday?

You read the GM story, right?

Bolt driving data went to LexisNexus, then to insurance companies, which raised individual rates and marked those people as high risk - likely forever.

This isn't a conspiracy theory - it happened. Not to advertisers, not to the NSA, but to insurance companies that actually used the data to raise rates. I honestly can't remember a previous time where we have direct practical evidence of an insurnce rate raise - long a hypothetical of data privacy experts.

There seems to be enough evidence that Ford MachE users have not suffered the same fate. I'm glad Ford didn't do that. I'd like Ford to make some stronger promises - like in their legal agreements - they will not do that. Breach of contract and harm in this case would be severe.

 

[azerik]

IDK, y’all better sell your Mach-E because there’s a greater than 0.1% chance Ford might possibly sell a few bytes of data to a 3rd party sometime in the next decade. Even though there’s zero evidence of that happening, you can’t be too safe. I mean, what if someone found out I drove my car a couple miles to the grocery store last Tuesday?

To buy a doughnut. That you ate while driving BCHF, Speed sign rec. Set 20mph over, took your eyes off the road twice, while using 1pd in 'drive mode not available' on the way to Home Depot My Trends trip, arriving with a brake regen score of 89..(I can go on and on and on)
Not tinfoil hatting this but they do have access to a very good amount of gathered data from the car, if some broker was to mine it.

 

[curtisfinney]

I wouldn't be so quick to dismiss this thread.

The MachE privacy document specifies several categories of data. Ford specifically states that data is not "all or nothing", as your comment implies.

First, Driving Data is specifically called out as separate, and, since it is linked to driving behavior, far scarier than all other data. It is not immediately intuitive that Driving Data (which is well defined in the document) should be linked to the Charging feature. The back end system that saves a few profiles for when you'd like to charge and to what level has nothing obvious to do with Driving. There is a feature to "save where you are now as a location", which by my reading isn't driving Data although Driving Data can be inferred, it would be super trivial to unlink the Location feature from Charging. It would also be very simple to have the app specify a location by zip code, address, or location of the phone, and have the car know its location. I have asked many times for a charge limit independent of location - it's actually terrible design to have an engineering-driven feature (limit charging to 90% is in the manual for my model and year) depend on location. Just have a charge limit independent of location.

Second, the document Ford has you sign says that Driving Data will be shared with unnamed Partners. It also states that the agreement can be changed at any time. This agreement trumps what anyone (including FoMoCo) states on a random forum somewhere. I can't take you to court when it turns out that Ford has been giving the data to a "partner", and that partner is Lexis/Nexis, and they have been selling it to an insurance company, and now I am forever practically uninsurable.

While I think Ford's heart is in the right place, they should:
1) decouple the Charge limiting feature feature from the willingness to provide Driving Data, and
2) they should remove the "partners" language from the privacy and data agreement.

In my opinion.

I have not decided, yet, to disable driving Data collection. I am unsure how, practically, I will follow the manual's policy of limiting to 90% without that feature. I bought a "dumb charger" believing that I could sensibly limit and control from the car, which is simpler and less error prone. I did not have any reason to believe (even as a subject matter expert on data privacy) that I would need to agree with sharing all driving, speed, braking data with FoMoCo and its partners in order to limit my charging to 90%, and I don't have an easy plan B (limiting at the charger is impractical for me for several reasons).

In my professional experience, employees at a company often don't read the legal agreements. They rely on a statement from someone else in the company, who is relying on something else, often from a lawyer who didn't understand the nuances of the terms in the agreement and the data systems involved. Often, also, the internal communications regarding data privacy language and decisions need to be marked "attorney client priv" and be limited, often to people who have gone through specific privacy training, meaning that broad internal understanding from engineering to comms is problematic. The answer is simple: if someone inside a company is going to make a statement about the legal agreement, they should spend the 30 minutes to read the legal agreement. In this case, Ford's privacy agreement is a model of clarity, so the read is relatively painless. Reads like that prevent people internally and externally from making statements that are incorrect on their face, which I have professionally seen at numerous companies.

Finally, it's not "obvious" that data needs to be shared with service providers in order to have a phone-based feature. End to end encryption is in use at plenty of companies for this type of scenario. While E2E encryption still presents an attack surface by scraping the screen of a person's device, that surface area is HIGHLY minimal and is not considered sharing with a service provider. If I can send an end-to-end encrypted message from my phone to my mom's phone (eg WhatsApp), if an active war like the Ukraine can use Telegram safely, then I can send an end-to-end encrypted message from my phone to my car and vice versa. The technology exists and Ford could certainly implement a version of it, they are limited by will.

To sum up,

1) Not obvious *at all* that phone based features require sharing with service providers despite the statements of Ford,
2) Not obvious that the charging feature requires from an engineering perspective either location or driving data,
3) Not obvious that the "partners" in the legal agreement might not be data brokers with unknown limits, liability, and purpose.
4) Not clear how to apply the driving manual's charging instructions without the charge limit feature.

I actually like charging based on location. I have time of day at home, but at work, I want it to charge anytime I plug in.

 

[bbulkow]

I actually like charging based on location. I have time of day at home, but at work, I want it to charge anytime I plug in.

I like it too.

I don't like giving my driving data to Ford's partners based on the feature.

I don't like that I can't set a limit for a location I've never charged at before.

Location based charging should be an *extra*. I should be able to set a charge limit for "unknown location".

For a new location, I have to start a charge session, disconnect, wait until the session shows up in the app, then set it as a location, then set the limit, then see if it actually got saved on the back end, then actually plug in the car.

 

[TruWrecks]

We need laws in the USA that making it illegal to sell customer data to any third party for any reason. If you want it, you need to send a written letter to the customer directly for each company that wants to see the data, If the customer doesn't answer the default should be a denied response. That is the only way it if fair to the the customers.

The problem is that laws made it profitable to sell customer data. Our data has become a multi-Billion dollar economy that businesses are not willing to give up.

 

[Gungrave223]

We need laws in the USA that making it illegal to sell customer data to any third party for any reason. If you want it, you need to send a written letter to the customer directly for each company that wants to see the data, If the customer doesn't answer the default should be a denied response. That is the only way it if fair to the the customers.

The problem is that laws made it profitable to sell customer data. Our data has become a multi-Billion dollar economy that businesses are not willing to give up.

[Sidebar]
But I think we can all agree that so long as the US have money in politics.... That will never happen...

The best we can do is be an advocate for ourselves. If you use a product or service and there isn't a price tag, then you can assume that you yourself is the actual product.

Now, let's assume that Ford doesn't actually sell or share driving data. And let's assume that they're using that data to somehow improve Ford services, my question would be how exactly does a person driving behaviors affects the design or functionality of a Ford vehicle?

 

[hartmms]

Haven't we already had this conversation before, but about financial data? Credit bureaus
collect our data without us being able to say no, or as a required consent if we want to setup a bank accound or take out a loan. They also sell that data all day long. They may claim they don't sell it if you freeze it, but is that really true? I still get credit card offeres in the mail from banks I have zero accounts with.

I will agree there needs to be better laws/regulations about how data is collected and how it is sold. They need to be strong enough so companies don't make it a Sophie's choice. "Please agree to connect your bidet to the internet and let us sell your data, otherwise 75% of the features that convinced you to purchase this device over our competition will be disabled".

 

[curtisfinney]

Agree with your thoughts on charging. I wonder how much of the software development team drives the cars they work on. I don’t get how they miss so much.

other thoughts-

I don’t mind sharing my data as long as it’s obfuscated and anyone can opt out. I see a ton of value in understanding driving patterns, habits, etc for continuous improvement in car development. For example, how often do people use the stupid knob for volume vs the steering wheel? How often do they change their HVAC fan speed?, etc

The reality today is either you are the product (Google, Facebook, GM) or you are not (Apple). Ford appears to be closer to Apple here, but time will tell

With regards to trends like do Mach E drivers drive more crazily than other drivers? Insurance companies already know a lot about the financial impact of Mach E drivers compared to other cars based on insurance claims. They don’t need data from Ford for this.

 

[azerik]

I will agree there needs to be better laws/regulations about how data is collected and how it is sold. They need to be strong enough so companies don't make it a Sophie's choice. "Please agree to connect your bidet to the internet and let us sell your data, otherwise 75% of the features that convinced you to purchase this device over our competition will be disabled".

This is a fantastic idea. Reality of the world we live in, gives you the option to 'opt out' of all that crap, thus crippling the thing you bought. It really should be very plainly listed on the side of whatever it is "requires X access from: this, this this, and this in order to use scheduled charging."

 

[Just Lurking]

I'm not a lawyer either but it is my understanding that writing disclosure takes higher legal precedent compared to spoken disclosure made by a spokesperson... And the written disclosure makes it very clear they do in fact sell personal data including geo location data ...

It would be nice if you could quote and link to specific sections of the privacy policy that indicates (or implies) the above. I skimmed the various privacy policies that seem to be relevant and didn't see evidence of them doing this without explicit permission.

I'm happy that Ford doesn't appear to have gone down the same road as GM at this time. I have also requested my data from Lexis-Nexis however I have not yet received it. I do agree with some others in this thread that the legal language (and the disclosures within the Sync settings themselves) could be a little tighter and more owner-friendly. It would be nice if there was a setting in Sync that very explicitly was limited to enabling FordPass features and for no other purpose.

 

[bbulkow]

With regards to trends like do Mach E drivers drive more crazily than other drivers? Insurance companies already know a lot about the financial impact of Mach E drivers compared to other cars based on insurance claims. They don’t need data from Ford for this.

Americans have a very contradictory set of thoughts regarding insurance, which is 90% of the problem. When *I* have a problem it's not *my* fault and I want a shared risk pool to help me out. When *you* exhibit risky behavior, your rates should go up.

The specific issue of insurance - especially legally mandated insurance like car insurance (and health insurance) - is we need regulations that are specific about the types of information an insurance company can use to set insurance rates. This fixes the issue of whether the data is available or not. Let's say data is gathered legally eg by license plate scanners in cars (this would absolutely be legal, you have no expectation of privacy regarding your speed an whereabouts based on visual observation) - we don't want insurance companies to use it to jack rates.

Or do we? This is the discussion we should have. If someone does drive "unsafely" (patterns that in other drivers lead to higher claims), or parks in areas with high crime risk, should their rates go up? Maybe even their medical insurance rates, if they spend time in an area with high asthma rates?

If a person is driving unsafely, don't we want them to have their rates go up? Right now I'm paying a lot for my MachE, partially because of the high price I paid, partially because EVs have strong acceleration so get in more accidents. The fact that I might not ever accelerate rapidly - I'm paying for other driver's bad skills. Do we, or don't we, want risky behavior to cause higher insurance rates?

Turns out these regulations *exactly* exist.

We allow insurance companies coarse grained information now. Accident history, car type, car price. Age, pretty sure. I think that's it.

We don't allow a variety of data to be used in setting insurance rates, such as where you live, your race, whether you are married or single, and I think your gender. I think the states have different laws regarding alternate data - imagine your social network posts. Insurance companies have been trying like crazy to get these laws overturned, because they want to jack up rates. They use the line that low-risk people will *save money* but the point of insurance is to share risk. I haven't looked at my state's codes on the topic in a few years, but I would be very surprised if something like this LexisNexus driving risk score could be used in setting insurance rates in my state.

 

[curtisfinney]

Interesting points. Health insurance covers some things that people have control over - diet, smoking, lifestyle and things people can’t control- their genetics. Driving habits are fully controlled by the driver. This is a critical difference.

I argue that speed, acceleration, and braking are not enough information to identify driving habits. I live in the Twin Cities and many of the driving norms are less safe. Most people don’t accelerate to highway speed until they are in traffic and they expect traffic to slow down to let them in. It’s much more complicated to enter traffic below the speed of traffic than at speed. When I drive an ICE, I smash the pedal down to get to speed. With my Mach E I accelerate fast to safely enter traffic. We also have some single lane ramps from highway to highway where people drive 30-45 mph when they should be going 55. This leads to more accidents.

We also have people head in parking vs back in. Head in has more accidents.

The nuance of these situations is very difficult to profile.

Sponsored