The fact that phone apps connected to new cars may permit marketers, insurers, and hackers to glean information about drivers has catalyzed concern.

“Modern cars are a privacy nightmare,” the Mozilla Foundation stated, adding, “Every car brand we looked at collects more personal data than necessary and uses that information for a reason other than to operate your vehicle and manage their relationship with you.”

“Many can track where you go and when, how fast you drive and how hard you brake, where you park and spend time, even what music or podcasts you listen to,” The Wall Street Journal noted. “Such information can be a gold mine for marketers and insurers—and a target for hackers.”

Car companies also have the capacity to collect a driver’s medical information and genetic information, the Mozilla Foundation concluded. Additionally, the foundation found that 84% of the car brands it researched admitted they could conceivably share the driver’s personal information with service providers, data brokers, and other businesses. 76% of the brands said they could sell the driver’s personal data.

“Car companies are becoming tech companies,” Thorin Klosowski of the Electronic Frontier Foundation said. “Self-policing hasn’t been shown in other tech industries to be a reliable way for companies to operate.”

The Federal Trade Commission warned in May, “Car manufacturers—and all businesses—should take note that the FTC will take action to protect consumers against the illegal collection, use, and disclosure of their personal data. Recent enforcement actions illustrate this point: Geolocation data is sensitive and subject to enhanced protections under the FTC Act.”

“Cars are much like mobile phones when it comes to revealing consumers’ persistent, precise location,” the FTC noted. “In a series of seminal cases in recent years, the Commission has established that the collection, use, and disclosure of location can be an unfair practice. In X-Mode, the FTC alleged that the data could be used to track people’s visits to sensitive locations like medical or reproductive health clinics, places of worship, or domestic abuse shelters. Similarly, in InMarket, the Commission alleged that the company’s internal use of sensitive data to group consumers into highly sensitive categories for advertising purposes was unlawful.”