Mozilla finds that 25 major car brands examined fail to adhere to the most basic privacy and security standards in their new internet-connected models
Bad news: your car is a spy. Every major car brand's new internet-connected models flunked privacy and security tests conducted by Mozilla.
Context & Ripple Effects
Mozilla’s assessment extends a long-running connected-vehicle security record: a Senate review of wireless vehicle systems had already highlighted risks to vehicle electronics and driver information.
The findings also follow researchers’ disclosure of automaker API flaws that could expose vehicle access, location, and customer data. Mozilla has previously applied privacy-and-security scrutiny across consumer connected devices.
First-order effects
- The 25 examined brands face a public benchmark that puts both their data practices and security safeguards under scrutiny for buyers of connected models.
- Drivers are left to evaluate connected-car features as a potential privacy and account-security exposure, rather than solely as a convenience feature.
Second-order effects
- Automakers and their software, API, and connected-service partners face pressure to demonstrate stronger controls, because weaknesses in any layer can expose vehicle functions or customer data.
- The report gives consumer advocates and security researchers a common baseline for comparing brands’ connected-car practices, alongside technical vulnerability disclosures.
Third-order effects
- If such findings persist, connected vehicles will increasingly be judged as data platforms with safety-adjacent security obligations, not just as automobiles with optional digital features.
- The recurring mix of wireless-system, in-vehicle-network, and API concerns suggests that durable improvement requires security and privacy practices across the vehicle and its online services.
The trend: Connected-car risk is converging privacy, account security, and vehicle-system security into a single product-governance challenge.