Manufacturers use personal vehicle data in various ways, the report states, often with vague terms, such as to "improve the customer experience," and usually involving third parties. Retention policies on how long information about drivers is stored vary considerably among manufacturers.
Car owners are often not explicitly made aware of data collection and, when they are, they often cannot opt out without disabling valuable features, such as navigation.
"Consumers don't know with whom that data is being shared," said Nate Cardozo, an attorney with the Electronic Frontier Foundation. "Take Ford Sync, for example. In its terms of service, it says it's collecting location data and call data if you use Sync to dictate emails."
Location data about drivers is continually sent to manufacturers, which allows navigation systems to update users on traffic and weather conditions and offer other services such as remote payment for parking.
Dominique Bonte, a director at ABI Research, said drivers should have to opt in before car companies can share data with outside parties. Bonte pointed to GM as an example of why an opt-out model isn't good enough.
In 2011, GM's OnStar in-vehicle communications service began collecting data on users without permission. The strategy was designed to improve the OnStar service, but GM also shared that data with third-party suppliers.
"They failed to observe the most essential rule in privacy. They were forced to stop using the data," Bonte said.
Last November, the world's 19 biggest automakers agreed to principles they said will protect driver privacy in an electronic age where in-vehicle computers collect everything from location and speed to what smartphone the driver uses.
A 19-page letter committing to the principles was submitted to the Federal Trade Commission from the industry's two largest trade associations, the Alliance of Automobile Manufacturers (AAM) and the Association of Global Automakers (AGA).
The AAM represents Detroit's Big Three automakers — Ford, GM and Chrysler — along with Toyota, Volkswagen AG and others. The AGA also represents Toyota, along with Honda Motor Co., Nissan Motor Co. and Hyundai Motor Co., among others.
Markey stated that the principles are an important first step, but they fall short in a number of key areas by not offering explicit assurances around choice and transparency.
The report's findings are based on responses from BMW, Chrysler, Ford, General Motors, Honda, Hyundai, Jaguar Land Rover, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Porsche, Subaru, Toyota, Volkswagen (with Audi), and Volvo. Letters were also sent to Aston Martin, Lamborghini, and Tesla, which did not respond.
Sign up for CIO Asia eNewsletters.