Connected cars pose privacy risks, Quebec report warns — 12 major vulnerabilities identified

Modern connected vehicles are tracking far more than just your location — and the risks are largely invisible to drivers, according to a new report from Quebec's committee on ethics in science and technology.

The 64-page report identifies 12 major privacy risks embedded in smart cars, including cybersecurity vulnerabilities, location tracking, unfair insurance practices based on driving data, and cameras that can record bystanders without consent.

Luc Bégin, the committee's head, acknowledged that connected vehicles offer real benefits. But because many drivers skip reading the terms and conditions — which can run dozens of pages — he says it's crucial people understand the risks to make informed decisions about what data they're sharing and with whom.

The report did not specify what the 12 risks are, but flagged that cameras in connected vehicles can record people outside the vehicle who have not consented to being filmed. Insurance companies increasingly use driving data collected by vehicles to set premiums, a practice the report identified as a vulnerability to unfair pricing. Location tracking allows detailed mapping of where you drive, when, and for how long — information that can be sold, subpoenaed, or breached.

Cybersecurity remains a core concern. Connected cars contain multiple entry points for hackers: infotainment systems that connect to smartphones, cloud services that store driving data, and wireless communication with other vehicles and infrastructure.

The report comes as connected vehicles become standard across manufacturers. Most new cars now include GPS navigation, cloud backup, remote diagnostics, and data-sharing agreements that buyers rarely review. Unlike traditional vehicle ownership, where the car itself was the extent of the transaction, connected vehicles create an ongoing relationship between the driver, the manufacturer, the insurer, and potentially dozens of third-party data brokers.