-I'm no mechanic, but I know one thing
most people haven't figured out about their cars.
They don't just guzzle gas -- they guzzle data.
You see, as of 2020, almost all new cars sold in America
will come with an Internet connection that's always on,
constantly sending your information to Lord only knows.
Older cars collect data, too.
Every time you plug in your phone,
there's a chance it's copy over your personal information.
What's it sharing, and with whom?
The dashboard doesn't say, it isn't in the owner's manual,
you won't find it in an app, either.
It's enough to make a guy want a car-sized tin-foil hat.
Okay, covering your car in foil is a little extreme.
But the reality is there are no federal laws
restricting how cars collect and use your data.
That means you are not really in the driver's seat.
So, what do you know about me,
2017 Chevrolet, and who are you sharing it with?
I asked the carmaker directly and they wouldn't tell me.
Trying to uncover my data's secret life is quite a trip.
Like 14 million other Chevies, this car has
OnStar, the General Motors connected-car service.
It's like a smart phone on wheels,
connected to over 200 different sensors.
Actually, that's more than my smart phone.
Chevy's long privacy policies say
GM could pretty much take whatever data it wants.
Inside the car, I couldn't find any ways to see my data,
delete my data,
or just cut off the Internet connection entirely.
To follow the data trail,
we're gonna have to hack our way in.
Meet Jim Mason.
He's got a PhD in engineering and hacks into cars
professionally to investigate accidents.
Yep, we're gonna borrow some CSI techniques.
Call it a privacy autopsy.
-I got to remove this now.
There's a screw right here.
There's a couple of them.
-Now, this kind of hacking isn't a security risk.
It requires hours of physical access
to get to the computer under the dashboard.
There's one important bit of car anatomy to know about --
cars have several computers potentially recording data.
The one Jim is tapping into runs the infotainment touch screen,
which connects everything from your navigation
to your smart phone.
After Jim carefully removes the computer,
he uses special software to download its contents.
Don't try this at home.
Later, I met with Jim in his office to sort what he found.
All right, Jim, so what does the car know about me?
-Well, let's find out.
-There on a map was the precise location of the warehouse
where we took apart the Chevy as well as other destinations,
like a hardware store I'd stopped at.
There were unique identifiers for my phone
and a detailed log of calls from the previous week.
There was a long list of contacts right down
to people's addresses, emails, and photos.
Infotainment systems can collect even more.
Jim has hacked Fords that record location
once every few minutes.
He's seen German cars with 300 gigabyte hard drives.
Others store audio recordings from voice commands.
And this is a two-year-old car.
Newer models have even more data points --
road conditions, whether you look sleepy
while you're driving,
also how you interact with all those apps.
To be clear, this is just what we were able
to pull off the infotainment computer.
It doesn't tell us what this Chevy shared with GM
through that cellular OnStar connection.
We know they're collecting enough to locate the car
anytime through the Chevy app and even deliver a driving score
based on how I accelerate, brake, and turn.
A GM spokesman told me much of this data
is highly technical, not linkable to individuals,
and doesn't leave the vehicle itself,
but GM acknowledges it collects driving data in real time,
and in its view, drivers gave them permission
when they bought the car with standard
OnStar service.
Automakers are looking for ways
to make money off of all our data.
GM recently captured what 90,000 people
were listening to on the radio, and then tries to look for links
to what sorts of shops they visited.
We've been down this fraught connected road before --
from phone apps and smart speakers to smart TVs.
Automakers haven't had a data reckoning yet,
but they're due for one.
In 2014, 20 carmakers, including GM,
promised to protect our privacy by following principles,
including providing information about what they collect
and offering ways to manage and delete it.
Yet, Chevy still doesn't have a tool
for customers to look at their data.
I called seven other major carmakers
and they didn't have one, either.
Once data about our lives gets shared, sold,
or stolen, we lose control,
and carmakers lag far behind in taking steps to protect us.
They'll only earn our trust when they learn to come clean
and treat our driving data like it belongs to us.