privacy4cars.com Proprietary & confidential

Solving at scale PI breaches 

and transparency of data 

practices in automotive

Presentation to the Department of Commerce’s IoT Board of Advisors

1

Andrea Amico

Founder and CEO

Privacy4Cars
privacy4cars.com Proprietary & confidential 2

About Privacy4Cars

• First and only privacy-tech focused on data captured, stored, transmitted, and leaked by vehicles

• Mission: “Driving Privacy” = free tools for consumers and robust tool for auto businesses

• We focus on problems that affect today millions on consumers

• We bring solutions that can be pragmatically implemented today and are backwards compatible with

the installed base of 273 million vehicles in the US

• Accomplishments: clear thought and market leader in the space, multiple patents, hundreds of 

businesses rely on our services to protect millions of consumers
privacy4cars.com Proprietary & confidential 3

Vehicles are Unencrypted Databases of Personal Information
privacy4cars.com Proprietary & confidential 4

The ugly facts on the ~40 million used vehicle sales

Consequently, more than 4 out of 5 cars are resold 

still containing the unencrypted personal 

information of previous occupants (incl. minors)...

2 out of 3 dealerships told mystery shoppers they 

have a process to delete PI prior to reselling...

...however, less than 5% of all dealerships have a 

robust and documented process to do so

...and 9 out of 10 mystery shoppers reported 

finding data of prior users just by test driving one 

or two random cars at those dealer lots!
privacy4cars.com Proprietary & confidential 5

Established Best Practice For Computers and Smartphones

NIST 800-88 Rev 1

mandates data clearing 

as a minimum 

reasonable standard
privacy4cars.com Proprietary & confidential 6

FTC + OEMs: delete in-vehicle PI at sale

• The FTC has issued 

guidance on the need 

to delete in-vehicle PI 

three times

• However, zero

enforcement, little 

changes in practices

Please note that the information stored in your Audi vehicle 

may be accessible to others who use your Audi vehicle or 

mobile device, and thus may be deleted, altered, or 

transferred. Please see your vehicle’s owner’s manual for 

information about how to remove the information stored in 

your Audi vehicle. 

If you sell or otherwise transfer your vehicle, it is your 

responsibility to delete all information (such as contacts, 

address look-ups, saved map addresses, or preferences) from 

the vehicle and contact us to transfer or cancel your 

account. If you do not delete this information, it may remain 

in the vehicle and may be accessible to future users of the 

vehicle. For instructions on how to delete information from 

your vehicle, please refer to your vehicle owner’s manual.
privacy4cars.com Proprietary & confidential 7

36 million families experience this without knowing

❖ Real example of used 

vehicle for sale

❖ Shot a 30-second 

video during a test 

drive

❖ Fully reidentified 

previous owner, wife, 

and son (a minor)

❖ Have received 

multiple reports from 

new owners of 

vehicles previously 

owned by celebrities, 

wealthy individuals, 

politicians
privacy4cars.com Proprietary & confidential 8

The ugly facts about automotive data practices transparency

In mystery shops, <5% of dealership salespeople 

correctly represented that (a) cars collect PI, and 

(b) OEMs have the rights to sell and share this PI

Most “big tech” privacy policies and TOS can be 

read in 15-25 minutes ...

...for automotive manufacturers, it takes an 

average of 2.5 hours (and up to 6 hours)

...and we could not find any evidence of collateral 

manufacturers make available to simply explain 

their data practices, and no salesperson was able 

to provide complete or accurate information 
privacy4cars.com Proprietary & confidential 9

COMING SOON: VehiclePrivacyReport.com

VIN-specific 

information

Recognize 

businesses 

who are 

taking action

List privacy 

protections

10 easy-to understand and 

standardized icons: 

a) 5 categories of data 

collected by automakers

b) 5 categories of who they 

share/sell information to 

Sources for full disclosure 

and independent read 

Each button can be clicked 

for more details and specific 

quotes from public docs
privacy4cars.com Proprietary & confidential 10

Clear government guidance and support is needed

Privacy must become a visible attribute: fair and 

transparent disclosures prevent market distortions 

and incentivize companies to improve practices

Focus on problems we can solve now for the 

vehicles that are currently in circulation! 

Vehicle retailers and renters must be told they have 

to follow the same basic hygiene rules that are 

commonplace for other consumer electronics

PRECEDENT: IIHS’s publication of the first crash 

tests sparked changes in consumer shopping 

behavior and unlocked investments in better safety
privacy4cars.com Proprietary & confidential

Thank You!

11

Download the free whitepaper at 

https://privacy4cars.com or ask for a 

copy at info@privacy4cars.com

Complying with FTC’s Updated Safeguards Rule

Deleting Consumer PI Stored in 

Vehicles: Dealership Guidelines