> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. However, if you use a wired USB connection then it does not do that (see the discussion here and elsewhere), so I exclusively use CarPlay via USB.

The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.

They are both very cagey with how they talk about this (or don't).

▲

embedding-shape 5 hours ago | parent | next [-]

And once you've gotten rid of Google and Apple, your telecom company tracks you, your CC payments help track you and even cameras in public do.

It's hard to not want to throw your hands in the air screaming "whatever" when almost everything you use in public is somehow used to track you either as you move around, or in the future.

▲

dualvariable 5 hours ago | parent | next [-]

This is one of those things that can't ever be solved with individual solutions but needs to be solved through legislation and standards, and ideally a fundamental right to privacy (and a fundamental redefinition of what privacy means when it comes to corporate surveillance of individuals).

▲

whamlastxmas 4 hours ago | parent [-]

I disagree. Government leaders will never give up their pipeline of knowing everything about everyone.

The real solution is technology, and popularization of something similar to Freenet, and hardware with an OS that is powerful enough for most people use their phones today, and as easy to use as Android or iOS.

Cell providers will still track and permanently store and sell your location information, and any conversation over SMS or non-E2E platforms will also still permanently stored, but at minimum you can have private conversations when you really want and your online activity (outside of banking etc) can be private.

Things will both get harder and easier with AI. Harder because soon the government will have AI track every single person on the planet, and an LLM will be reading every text, email, and online post you make to make sure you're not a threat to national security or some excuse around CSAM (which I'm not advocating for, obv). On the flipside, as we move away from things like browsers, and can have local LLM models do most of our web browsing for us and present it however we want (free of ads, tracking, annoying styling, cookie banners), it will be easier to not have friction for changing browsers and operating systems etc to protect your privacy.

▲

throwway120385 2 hours ago | parent | next [-]

I guess we'll just sit on our hands and do nothing, then.

▲

foresto 3 hours ago | parent | prev [-]

> Government leaders will never give up their pipeline of knowing everything about everyone.

Then let us hire different leaders into government. Public servants, not overlords.

▲

HenryBemis 3 hours ago | parent [-]

If you have noticed, every independent candidate almost never gets elected. Vast majority of those who say they will "change the country to the better" either never get elected or are ousted early on. And those who stay change their tune.

I fear that only blackmail-able people with the potential to win elections, get the support, so that they are beholden to someone who ultimately gives them the job (e.g. funding their campaign) and has to return the favor x10 when elected, so promises go out the window and new reality sets in.

▲

mothballed 2 hours ago | parent [-]

Someone tried to create an entirely new country with minimal governance by dumping sand on a submerged reef until it became an island[]. Even then it was quickly co-opted by the nearing statist powers (Tonga) with the blessing of western powers.

So it's not just that the primary process will crush anyone who will seriously roll back government powers. They won't even let anyone peacefully create an entirely new fucking island to try and get away from the tyrants and do it while leaving everyone else alone and not messing with the powers that be.

[] https://en.wikipedia.org/wiki/Republic_of_Minerva

▲

anonymars 2 hours ago | parent [-]

Isn't that the libertarian paradox in a nutshell, the entire reason why "government" exists? Because in reality, the alternative is "might makes right" and a larger, stronger group will band together and steamroll the smaller and uncoordinated individuals?

	▲	mothballed an hour ago \| parent [-]
		Government is might makes right, just with a nice name slapped on it. Minerva was minarchist, not anarchist, but for whatever reason they chose not to defend their country by force. Somaliland and the remains of Rojava come to mind as present-day ~minarchist governments that defended their territory by force and ~succeeded. The point being is these kind of changes won't be allowed by election or peacefully. The primaries stop the election process and the militaries stop the peaceful separation process. America did have a period of relatively small government intervention at the beginning, but that took a war with Britain. It also had some periods of it during the pre-founding (some of 1600s Pennsylvania and Rhode Island while Britain was occupied elsewhere). Pennsylvania (before it was a state) in particular was basically straight up anarchist for I want to say, about 20 years.

▲

simplyluke an hour ago | parent | prev | next [-]

> your CC payments help track

Not only that. Them and the point-of-sale vendors (aptly shortened PoS), sell that data. They tend to attempt to do this anonymized. How successful they are in anonymizing that is very much so up for debate.

The websites (and even their retail locations) you buy from send your purchase data to meta and other advertisers directly via APIs so they can better track their marketing conversion rates. You can browse their APIs [1][2] to see what kind of data they like to get, but it tends to be every piece of identification they have on you. Rewards programs make this a much richer data set. You don't need to be a user of Google/Meta for them to build a marketing profile based on this. Google links your physical conversion from ads based on your maps data. Facebook does the same if you give them your location data. Many retailers attempt to use the bluetooth/wifi signals from your phone to track the same data even if you pay in cash [3].

There's no legal framework preventing this outside of the EU and California.

1: https://developers.facebook.com/documentation/ads-commerce/c... 2: https://developers.google.com/google-ads/api/docs/conversion... 3: https://www.nytimes.com/interactive/2019/06/14/opinion/bluet...

▲

asdff 15 minutes ago | parent | prev | next [-]

At least you can shut your cellphone off and pay in cash.

▲

everdrive 4 hours ago | parent | prev | next [-]

Nonetheless I'll still try to maintain what privacy I can.

▲

asdefghyk an hour ago | parent | prev | next [-]

RE .... company tracks you ..... [ somewhat off topis ]

Did you know ... in many countries government tracks car number plates and the data is stored for many years.

▲

drnick1 2 hours ago | parent | prev | next [-]

> And once you've gotten rid of Google and Apple, your telecom company tracks you, your CC payments help track you and even cameras in public do.

Maybe, but what happens without the mod described is that Google and Apple track you in addition to the telecom company. That, of course, assumes that you carry a cell phone tied to your identity. Some people refuse to carry cell phones altogether because of the privacy implications, or use them mostly in airplane mode with an anonymous SIM for backup.

▲

zekyl314 4 hours ago | parent | prev [-]

Exactly, and more and more places are removing cash as a payment option :(

▲

razakel 4 hours ago | parent [-]

Cash handling isn't free, and for smaller businesses might actually end up being more expensive than accepting electronic payments.

▲

bigfishrunning 4 hours ago | parent [-]

If your margins are so razor thin that the cost of handling cash is significant, you need to raise your prices. Cash is legal tender -- not accepting it for in-person transactions is really shitty (maybe shouldn't be allowed?)

▲

9x39 2 hours ago | parent | next [-]

> you need to raise your prices.

And if the competitor doesn't? Ouch.

I think there should be a "digital equivalency act" or something to hamper full digital capture, but my feelings aside, there's a few powers that dislike cash:

Free people like cash, but businesses with low-skill/low-trust workers dislike cash because despite the CC fees, there is less theft, less overhead with cash reconciliation, cameras to watch cash with, less safes to manage, less cash pickup services.

The IRS hates it because there is a cash industry (as there should be, imo, but I'm injecting too much opinion already) that doesn't report earnings. I personally know barbers, housecleaners, handymen that admit to reporting no or few earnings, and synthesize a living off cash and benefits. If you stop paying taxes, this actually works pretty well compared to a low-end tax-paying job. My housecleaner takes overseas vacations (like, thrifty ones in hostels) 2-3 times a year this way.

Banks (arguably the IRS again, deputizing them with KYC) squint at you when you deposit or withdraw significant cash - ask any weed industry participants. Untrackable currency is a natural catch-all for people they don't want to bank with, so it's just friction and headache naturally.

▲

leothecool 4 hours ago | parent | prev | next [-]

You can't even get coins counted for free at retail banks anymore. Cash handling is too expensive even for the place that ostensibly provides cash handling services to the general public.

	▲	speed_spread 3 hours ago \| parent [-]
		Just make all your prices round up to the nearest dollar bill after tax. Eliminate coins at the source.

▲

razakel 3 hours ago | parent | prev | next [-]

"Legal tender" only means it must be accepted to settle a debt.

▲

rdiddly 3 hours ago | parent [-]

Walking out of the store with groceries generates a debt, no?

▲

phainopepla2 2 hours ago | parent [-]

I believe that's more likely to generate a criminal charge

▲

dotancohen 2 hours ago | parent [-]

Then how about paying after ordering and eating a meal?

	▲	pixl97 an hour ago \| parent [-]
		Depends. If there was a posted notice that no cash is accepted it's unlikely you'll get a criminal charge, but you can get civilly sued. Most places will just accept the cash then put up a picture saying "If this asshole shows up again, trespass him"

▲

fragmede 4 hours ago | parent | prev | next [-]

You can't go into a store with a gun and demand the cash out of the register if there is no cash.

	▲	skrtskrt 2 hours ago \| parent \| next [-]
		The actual cost is shrinkage from general human accounting mistakes and all the extra time it takes to manage. I worked at the gym in college and we sold like one item a day and it was still a whole bunch of work and pain to keep up on the cash counts correct. I definitely believe that all businesses should take cash as much as is reasonable, but logistically it is understandable why some choose not to
	▲	bigfishrunning 3 hours ago \| parent \| prev [-]
		You shouldn't do that anyway; also, you can't skim a credit card I'm not using/carrying. There are crime arguments on both sides.

▲

whamlastxmas 4 hours ago | parent | prev [-]

It's not about "just raise prices", it's about some industries (e.g. upstart restaurants) that already have massive failure rates and have hyper competition. Even airlines don't make money on flights, and instead only on selling credits cards or other perks.

If your operating costs are some percentage higher for accepting cash versus the coffee shop across the street that doesn't, you're more likely to fail.

▲

bigfishrunning 4 hours ago | parent | next [-]

If everyone has to accept cash, then everyone has the same costs and the point is moot. At any rate, courts are required to accept legal tender, and I think that requirement ought to extend to businesses as well.

	▲	angoragoats an hour ago \| parent [-]
		> At any rate, courts are required to accept legal tender Assuming you’re talking about the US here: there is no such requirement, at least not at the federal level. Individual states may have their own laws, but see for example this notice [0] from a Texas federal court that they will no longer accept cash as of May 21, 2021. [0] https://www.txnb.uscourts.gov/news/notice-court-will-no-long...

▲

underlipton 3 hours ago | parent | prev [-]

The real problem for those businesses is way upstream of payment processing costs, namely in the cost of business loans, the general poverty of the American consumer, and (for brick-and-mortars) zoning. The latter is a matter of getting municipalities to relax restrictions put in place mid-century literally to support segregation, and the former two are a matter of forcing the wealthy to eat the costs of their poor decisions from the last few decades, rather than continuing to allow them to socialize related losses through avenues like scandalously low labor pay vis a vis productivity and various investment/asset market scams (which, through housing and passive retirement investment, they've roped in Boomers and older Gen-Xers).

If you wish to make an apple pie shop from scratch, you must first invent an economy that isn't hamstrung by legacy obligations from ventures that people who are long-dead somehow were allowed to finance with your paycheck. (Somewhere, a middle-aged nepo-baby is clutching her pearls at the thought, and I just think we should cherish, rather than shy from, the opportunity to throw her and her siblings under the bus.)

▲

rkagerer 4 hours ago | parent | prev | next [-]

Is there any information about precisely what vehicle telemetry they capture and retain?

I know the laws are far from perfect, but isn't there some legislation compelling them to disclose what they collect?

What specifically would be the most relevant law/regulation? (If it varies by geography, pick any major market, eg. California, that is big enough to impact their engineering design and the content of published material). You mentioned they're cagey, and my aim is to examine if there's a gap between what they're supposed to disclose and what they do, which could be rectified by litigation. Eg. If they just say "vehicle telemetry" that doesn't tell you much, and I'd happily contribute to an EFF effort to get them to elaborate.

Alternatively someone who works close to this code could provide some examples of what a "typical" smartphone OS platform collects these days.

▲

pbhjpbhj 2 hours ago | parent | next [-]

GDPR should work to get a copy of the data, also it would only be allowed to be collected with explicit permission -- I'm assuming that data about your car is PII about you.

▲

KennyBlanken 2 hours ago | parent | prev [-]

Generally speaking the author seems to wave a bunch of conspiracies around without the evidence to support it, or frankly, much technical knowledge.

The author seems unaware that in iOS you can uncheck nearly every single location usage the OS and Apple Apps themselves collect.

On iOS not only can you shut off things like traffic reporting while using Maps and cellular/WiFI/Bluetooth data collection...unlike Google, Apple will let you use those services without requiring you contribute to them.

	▲	mmooss an hour ago \| parent [-]
		> the author seems to wave a bunch of conspiracies around without the evidence to support it The author provides links at the top to credible reporting on relatively well-known privacy concerns.

▲

drnick1 6 hours ago | parent | prev | next [-]

You need GrapheneOS to sever the link to Google. You can also deny specify apps and services Internet access.

▲

MSFT_Edging 4 hours ago | parent | next [-]

Is android auto still available with Graphene? AA is genuinely one of the few life-changing features introduced in the last decade that I'd prefer not to go without.

	▲	subscribed 4 hours ago \| parent [-]
		Yep and works flawlessly via USB for me. That was a deal breaker for me for the longest time too. Allowing it to connect over Bluetooth requires granting AA plenty of additional permissions which I didn't want to do (but hey, on GOS at least you can muzzle that thing).

▲

wing-_-nuts 2 hours ago | parent | prev [-]

I like the idea of graphene, but I worry my banking / brokerage apps wouldn't work anymore and that'd be a deal breaker

	▲	drnick1 2 hours ago \| parent [-]
		The Graphene community maintains a list of compatible banking apps. Another possibility is to keep an old/cheap, stock Android phone at home with WiFi only for apps like this.

▲

gruez 5 hours ago | parent | prev | next [-]

>if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota

Source? Can bluetooth devices do that without the user's knowledge?

	▲	MRPockets 5 hours ago \| parent [-]
		I assume that the original article statement is referring to connecting to CarPlay/Android Auto wirelessly, not simply connecting via Bluetooth for a speaker-type setup. But I do not know that this is the case. Certainly, I would assume all privacy bets are off if you connect CarPlay/Android Auto in any manner.

▲

Angostura 5 hours ago | parent | prev | next [-]

Standard Carplay is essentially an additional screen for your phone - your existiing privacy settings carry across. What's your concern?

▲

vk6flab 5 hours ago | parent [-]

Unfortunately that's not quite true, since the "app screen" on the media display during Android Auto use has an additional "Toyota" icon that AFAIK isn't coming from my phone.

What's more concerning is that it's entirely unclear exactly what information is shared over the Android Auto link, in my case, over Bluetooth.

▲

tadfisher 4 hours ago | parent | next [-]

There's a protobuf-based API for two-way communication between the Android Auto app and the head unit [0]. It depends on what the headunit supports, but this includes data such as GPS location, steering wheel button activation, accelerometer data, parking brake activation, gear selection, touch screen input, dimmer switch position, odometer, and much more.

A lot of this has obvious use within the AA interface; for example, the parking brake position is used to prevent scrolling too far through lists, and the car's GPS is usually much more accurate than the phone's and better on the phone battery.

0: https://github.com/f1xpl/aasdk/tree/development/aasdk_proto (pretty old reverse-engineering effort)

▲

hamburglar 4 hours ago | parent [-]

One of the things I notice CarPlay has access to is the fan speed. In one of my vehicles, when I say “hey siri” it turns the HVAC fan down so it can hear me better. I’ve always wondered if the interface is the phone telling the car “hey make things quieter” or if it’s explicitly turning the fan down. It’s also interesting that this only happens in one of my cars. I assume it’s because the other car is a higher end vehicle and has a quieter fan.

▲

dmitrygr 3 hours ago | parent [-]

In GM cars (as observed in my last few), the logic is in the head unit: "mic on -> hvac lower", while "hotword detect" uses a different "mic on" method that does not

EDIT, previously "does not" above said "doe snot", which explains the reply below

▲

addaon 3 hours ago | parent [-]

I'm sure it's not great, but deer mucus is a bit of an extreme description.

	▲	tadfisher 2 hours ago \| parent \| next [-]
		I appreciate this comment, FWIW.
	▲	dmitrygr an hour ago \| parent \| prev [-]
		I never learned to properly touch type, i have my own method, somehow, which uses two fingers of the left hand and three of the right. Spacebar being pressed too soon or too late is, sadly, common :(

▲

adestefan 4 hours ago | parent | prev [-]

That icon is a "close Carplay/Auto" button. My Subaru has a Subaru button; my wife's Mazda has a Mazda button.

▲

jklinger410 5 hours ago | parent | prev | next [-]

> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota

How?

▲

colordrops 5 hours ago | parent [-]

They are probably confusing google auto with bluetooth.

▲

brg1007 4 hours ago | parent [-]

On Android there is an option called "Bluetooth tethering - Share phone's internet connection via Bluetooth" . If it is On and you are connected to the car's bluetooth it will have internet access via your phone.

	▲	jklinger410 4 hours ago \| parent [-]
		I'm suspicious that the car's system can do this. I don't think we should be assuming your car can tether internet through bluetooth until we see someone snoop Toyota-bound traffic being routed through their phone.

▲

zackify 6 hours ago | parent | prev | next [-]

I use android auto through grapheneos thankfully! this is crazy!

▲

b00ty4breakfast 6 hours ago | parent | next [-]

this sounds like donning a TNT vest to diffuse a bomb

▲

andrepd 6 hours ago | parent | prev [-]

Can you clarify? Does it feed it bullshit data? Because android auto expects car telemetry data which it streams to Google's servers. Which is a big no-no for me for obvious reasons.

▲

piaste 5 hours ago | parent [-]

It doesn't stop Android Auto from doing whatever with the car data, but it's sandboxed to have no more default privileges than a regular app, so it can be denied access to your phone's data by default (apps, contacts, etc.). Wireless AA will only work if you grant it extra privileges; wired AA does not need them.

You can also "firewall" AA via something like TrackerControl, this would let you block connections to eg. Google Analytics servers without denying network access altogether (which would likely cause AA to stop working). I've only used AA with short-term rentals so I didn't spend too much time exploring these options.

	▲	andrepd 5 hours ago \| parent [-]
		Fair enough. Streaming my location and an OBD dump to Google whenever I'm driving is a non-starter for me, so I'll stick with the aux cord!

▲

arkadiyt 6 hours ago | parent | prev | next [-]

In a perfect world they wouldn't collect it either, but I'd rather Apple have it than the car manufacturer (or rather, only Apple vs both Apple and the car manufacturer)

▲

everdrive 6 hours ago | parent | prev | next [-]

What about if it's just paired as an audio device rather than through an app?

▲

embedding-shape 5 hours ago | parent [-]

Don't get CarPlay/Android Auto that way though, so no navigation/maps for example.

▲

everdrive 4 hours ago | parent | next [-]

Sure -- I'm not asking a general question, but thinking about my wife's phone, which is paired as an audio device. It sounds like we're probably in good shape.

▲

Jblx2 4 hours ago | parent | prev [-]

Are there any cars that support CarPlay/Android Auto that don't have built-in navigation/maps?

▲

embedding-shape 4 hours ago | parent | next [-]

AFAIK, every single one of those "built-in navigation/maps" either require the car itself is internet connected (with its own modem), or that you every year get a SD card with map updates to stick into the car.

I guess it's fine in an emergency, but I wouldn't want to use it day-by-day, the live traffic/road closure information in my case ends up saving us tons of time over the year.

	▲	Jblx2 an hour ago \| parent [-]
		It is also OK if you only use GPS 3 times per year.

▲

grokx 4 hours ago | parent | prev | next [-]

Mine is from 2013. There is no longer map updates for the built in nav system.

So I bought an Android auto / Car play module that integrates with the car touch screen. Now I have up to date maps and navigation for ever. :)

▲

bigfishrunning 4 hours ago | parent | prev | next [-]

My 2019 Subaru legacy supports auto and does not have built in navigation. The aftermarket dashboard display in my 2011 Ford ranger also supports android auto but has no built in GPS.

▲

hoistbypetard 4 hours ago | parent | prev | next [-]

Mine (a US 2017 subaru impreza) supports both and doesn't have built-in navigation/maps.

▲

vel0city 4 hours ago | parent | prev [-]

Yes. I can't remember which cars (some base-model Hyundais I think) but I know I've rented a few that did have Android Auto but did not have any navigation included.

▲

internet2000 2 hours ago | parent | prev | next [-]

I trust Apple more than I trust Toyota.

▲

sneak 2 hours ago | parent [-]

You shouldn’t. Apple preserves backdoors in iCloud encryption to enable warrantless government surveillance. They have no other option.

▲

willis936 2 hours ago | parent [-]

It's weird to hang up on this specific item because they do actually offer an E2EE icloud option. Lose your key: lose your data.

https://support.apple.com/en-us/108756

	▲	sneak 38 minutes ago \| parent [-]
		Nobody has it on, and unless BOTH sides are using it, your iMessage conversations are all readable by Apple, because they are backed up twice - one for each end. This option is also disabled in the UK - an intentionally preserved backdoor for government access. https://support.apple.com/en-gb/122234

▲

phony-account 3 hours ago | parent | prev | next [-]

> The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.

Do you have evidence or a citation for this? Or is it just the sort of statement that’s made in the pretty certain expectation of upvotes on HN?

▲

nullc 4 hours ago | parent | prev | next [-]

> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota [...] so I exclusively use CarPlay via USB.

I would be concerned that a passenger connecting their phone to it while I was driving.

In other cars I've been successful picking up the relevant modules for peanuts from surplus/scrap then just desoldering the RF-active components (like bt radios, etc) and swapping them in. YMMV but if it doesn't work you're just out the cost of a junk part.

Even if some radio feature is benign its existence means that its hard to be confident that there isn't some other telemetry feature you missed. With no connectivity at all you don't need to worry that you missed something because you can monitor the car with a spectrum analyzer and observe its never transmitting.

Unfortunately in some newer cars you can't swap any modules without a dealer tool to pair the module to the car, presumably in a bid to prevent third parties from fixing the car (presumably preventing people from lobotomizing their surveillance isn't on their radar yet).

▲

downrightmike 6 hours ago | parent | prev [-]

They are cagey because they get nearly $100k upfront with crazy interest rates, and then they make a ton of money through their spyware.

▲

pfortuny 6 hours ago | parent [-]

Honest question: what do you mean?

▲

downrightmike 6 hours ago | parent [-]

You pay inflated prices for the car and then they still steal and sell your data. This isn't hard to understand, same thing smart TV mfg do.

▲

Jblx2 5 hours ago | parent | next [-]

$100k is in Canadian dollars? I just added almost every accessory/package and option to the the 2026 GR Sport Plug-in Hybrid RAV4, and it came out to $55,821. If there were options that were nearly identical, I only added the most expensive one. So I only added one hammock ($340) and one of the Pelican Dayventure Backpack Cooler ($301). This includes the dog first-aid kit, and the human first-aid kit. Maybe all the options will come through this link:

https://www.toyota.com/configurator/build/step/summary/year/...

...maybe there is a lot of dealer markup in your area?

▲

epicide 6 hours ago | parent | prev [-]

I think you mean "subsidized" instead of "inflated".

▲

Rooster61 6 hours ago | parent | next [-]

No, they meant inflated. Cars are quite expensive right now, and dealers are notorious for raking in cash through financing. If they were subsidized, prices would be lower to increase user base, as in the aforementioned dynamic present in the current smart TV market.

I think the inital point was that car manufacturers/dealers are double dipping through initial cost/interest AND data harvesting.

▲

alext5 6 hours ago | parent | prev [-]

Both an high end tv or a car are expensive items where the manufacturer shouldn’t be making additional income on your personal data.

A free 55 inch tv supported by ads would be subsidized. A big ticket item price likely does not change even if it intrudes on your privacy and the manufacturer makes additional income on your data. In that sense it’s not subsidized it’s just greedy business practices.

	▲	funimpoded 3 hours ago \| parent [-]
		I haven't had any insight into the industry lately, but did work for a company in that space several years ago. Most (all?) ordinary TVs, plus things like Roku streaming devices, are sold essentially at-cost. The profit comes from ads and information-brokering stuff. This makes it basically impossible to break into the market without doing the same thing.