NEW YORK — Your car is spying on you.
That is one takeaway from the fast, detailed data that Tesla collected on the driver of one of its Cybertrucks that exploded in Las Vegas earlier this week. Privacy data experts say the deep dive by Elon Musk’s company was impressive, but also shines a spotlight on a difficult question as vehicles become less like cars and more like computers on wheels.
Is your car company violating your privacy rights?
“You might want law enforcement to have the data to crack down on criminals, but can anyone have access to it?” said Jodi Daniels, CEO of privacy consulting firm Red Clover Advisors. “Where is the line?”
Many of the latest cars not only know where you’ve been and where you are going, but also often have access to your contacts, your call logs, your texts and other sensitive information thanks to cell phone syncing.
The data collected by Musk’s electric car company after the Cybertruck packed with fireworks burst into flames in front of the Trump International Hotel Wednesday proved valuable to police in helping track the driver’s movements.
Within hours of the New Year’s Day explosion that burned the driver beyond recognition and injured seven, Tesla was able to track Matthew Livelsberger’s movements in detail from Denver to Las Vegas, and also confirm that the problem was explosives in the truck, not the truck itself. Tesla used data collected from charging stations and from onboard software — and to great acclaim.
“I have to thank Elon Musk, specifically,” said Las Vegas Metropolitan Police Department Sheriff Kevin McMahill to reporters. “He gave us quite a bit of additional information.“
Some privacy experts were less enthusiastic.
“It reveals the kind of sweeping surveillance going on,” said David Choffnes, executive director of the Cybersecurity and Privacy Institute at Northeastern University in Boston. “When something bad happens, it’s helpful, but it’s a double edged sword. Companies that collect this data can abuse it.”
General Motors, for instance, was sued in August by the Texas attorney general for allegedly selling data from 1.8 million drivers to insurance companies without their consent.
Cars equipped with cameras to enable self-driving features have added a new security risk. Tesla itself came under fire after Reuters reported how employees from 2019 through 2022 shared drivers’ sensitive videos and recordings with each other, including videos of road rage incidents and, in one case, nudity.
Tesla did not respond to emailed questions about its privacy policy. On its website, Tesla says it follows strict rules for keeping names and information private.
“No one but you would have knowledge of your activities, location, or a history of where you’ve been,” according to a statement. “Your information is kept private and secure.”
Auto analyst Sam Abuelsamid at Telemetry Insight, said he doesn’t think Tesla is “especially worse” than other auto companies in handling customer data, but he is still concerned.
“This is one of the biggest ethical issues we have around modern vehicles. They’re connected,” he said. “Consumers need to have control over their data.”
Tensions were high when the Cybertruck parked at the front doors of Trump’s hotel began smoking, then burst into flames. Just hours earlier a driver in another vehicle using the same peer-to-peer car rental service, Turo, had killed 15 people after slamming into a crowd in New Orleans in what law enforcement is calling a terrorist attack.
Shortly before 1 p.m., the Las Vegas police announced they were investigating a second incident.
“The fire is out,” the police announced on the social media platform X, one of Musk’s other companies. “Please avoid the area.”
Tesla shortly thereafter swung into action.
“The whole Tesla senior team is investigating this matter right now,” Musk wrote on X. “Will post more information as soon as we learn anything.”
Over the next few hours, Tesla was able to piece together Livelsberger’s journey over five days and four states by tracking, among other things, his recharging stops in various locations, including Monument, Colorado, Albuquerque, New Mexico, and Flagstaff, Arizona.
There are no federal laws regulating car data similar to those that restrict information collection and sharing by banks and health care providers. And state laws are a grab-bag of various rules, mostly focused on data privacy in general.
Daniels, the privacy consultant, thinks that new national laws are needed because rules have not kept up with technology.
“I think law enforcement should have access to data that can help them solve things quickly,” she said. “But we have a right to privacy.”
