privacy policy

[photontorque]

There’s been lots of exciting news from Rivian recently, with direct updates from Rivian, and glowing 3rd party reviews. The truck sounds extraordinary!

Another update to their website is their privacy policy: https://rivian.com/legal/privacy-policy

I do not find their privacy policy extraordinary, and in fact it makes me quite nervous. This post is a little long, apologies in advance. Skip this thread if you’re not interested in privacy policy. If you are, read on!

In sum, the privacy policy seems to say that Rivian will be able to do essentially what they want with customer personal information of any type; and in fact they state they will be sharing personal information with partners.

“Sharing. We share your personal information to provide you with products and services, to improve the quality, safety, and security of products and services, to comply with applicable law, to respond to your requests, marketing or other business purposes, subject to your consent where required.”

There is a long list of organizations with whom Rivian will share information, and right at the top of this list is: “Technology and Other Service Providers. With software, IT, customer relationship management, wireless, mapping, data analytics, cybersecurity, charging, cloud service, consultants, financial, legal and other similar providers we use to support our business.” Holy crap. That’s pretty much anyone who can say the word “computer”.

Also, it’s not too hard to read between the lines here: Amazon. It may not matter whether you activate Alexa or not, it looks like Amazon will get your data if you drive a Rivian.

The Amazon thing stands out a little bit because some senior person from Rivian, during the Mill Valley event, I think, said users can disable Alexa if they are worried about privacy. That’s a bit disingenuous if in fact Amazon will get the data regardless.

And by the way, at the very top of the privacy information webpage is “Rivian is committed to respecting your privacy”. They respect it so much they share it with the world?!

They are collecting a whole lotta information from the vehicles themselves, which is also detailed on the website. One interesting tidbit is they record whether or not there is a passenger in the car.

I’m not so naïve as to think Rivian is unique in this regard, I know other companies engage in this kind of tracking too. But the “well, everybody else does it” excuse doesn’t make something right; my personal perspective is that the data collection policies of many companies is invasive and should be illegal. Because they are starting from the ground-up, Rivian has the opportunity to not screw with its customers in the way other companies do.

Rivian is working hard to brand themselves as a thoughtful, respectful company. (Environmentally conscious, sustainable practices) I applaud this approach, but to me it falls flat if they are simultaneously treating customers (who already are paying a big chunk of change for the vehicles!) as a commodity.

If nothing else, Rivian should give customers options: “opt out”, or “opt in but anonymous”, or opt in all the way.

Sponsored

 

[PastyPilgrim]

Straight up I don't have a lot of faith in Rivian to make me happy with regards to privacy. They've got their hands in too many pies (insurance, finance, self-driving aspirations, amazon, etc.) to be privacy-focused, especially since many of those pies involve external partners.

That said, I don't think there are a lot of options in this space right now if you're privacy-focused. Maaaaaybe if you assume Ford is a dinosaur company that wouldn't know what to do with your data the lightning would be viable. But sometimes with dinosaur companies it goes the other way because they just offload all of your data indescriminately because they don't know what to do with it themselves.

One possibility that I'd be interested to try out is not subscribing to a cell service through Rivian and instead subscribing for cell service through another provider that would allow you to use an external hotspot device that your truck would connect to via wifi and would allow you to control routing. From there, depending on how Rivian handles phoning home, you may be able to block a lot of data collection pipelines. Alternatively, early Rivians on early firmware may be hackable such that you could block services natively on the truck.

Or maybe someday if they add auto/carplay you could get by with no internet connection on the truck. Really I'd just want data for maps (using my phone+bluetooth for entertainment is fine with me) so perhaps there's a way to download map packs to your truck and only connect to the internet as needed to update them.

 

[photontorque]

One possibility that I'd be interested to try out is not subscribing to a cell service through Rivian and instead subscribing for cell service through another provider that would allow you to use an external hotspot device that your truck would connect to via wifi and would allow you to control routing. From there, depending on how Rivian handles phoning home, you may be able to block a lot of data collection pipelines. Alternatively, early Rivians on early firmware may be hackable such that you could block services natively on the truck.

Or maybe someday if they add auto/carplay you could get by with no internet connection on the truck. Really I'd just want data for maps (using my phone+bluetooth for entertainment is fine with me) so perhaps there's a way to download map packs to your truck and only connect to the internet as needed to update them.

Hmmm, interesting!

I've just assumed that the vehicle is talking to the mothership regardless of whether the owner has subscribed to a data plan through the vehicle. If Rivian (or other automotive manufacturers) can get you to pay for the data plan by tacking on a few features via a paid subscription plan, so much the better for them.

But, my cars are ancient (relatively speaking) and never had any connectivity, so I've never had exposure to a vehicle with this kind of functionality.

So shutting down at least some of the data collection could be as simple as not subscribing to whatever monthly fee Rivian has for "Rivian Membership"?

Is that the way Tesla works, or other EVs?

Sorry for the basic questions, this is new territory for me.

 

[Gator42]

Hmmm, interesting!

I've just assumed that the vehicle is talking to the mothership regardless of whether the owner has subscribed to a data plan through the vehicle. If Rivian (or other automotive manufacturers) can get you to pay for the data plan by tacking on a few features via a paid subscription plan, so much the better for them.

But, my cars are ancient (relatively speaking) and never had any connectivity, so I've never had exposure to a vehicle with this kind of functionality.

So shutting down at least some of the data collection could be as simple as not subscribing to whatever monthly fee Rivian has for "Rivian Membership"?

Is that the way Tesla works, or other EVs?

Sorry for the basic questions, this is new territory for me.

I know my Defender essentially has two separate eSIMs and data streams- one for ‘logic’ which is for things like nav/OTA software updates/vehicle metrics/remote app, and one for ‘creative’ or infotainment. Canceling the infotainment subscription does not stop the logic side.

 

[R_1_T]

Hmmm, interesting!

I've just assumed that the vehicle is talking to the mothership regardless of whether the owner has subscribed to a data plan through the vehicle. If Rivian (or other automotive manufacturers) can get you to pay for the data plan by tacking on a few features via a paid subscription plan, so much the better for them.

But, my cars are ancient (relatively speaking) and never had any connectivity, so I've never had exposure to a vehicle with this kind of functionality.

So shutting down at least some of the data collection could be as simple as not subscribing to whatever monthly fee Rivian has for "Rivian Membership"?

Is that the way Tesla works, or other EVs?

Sorry for the basic questions, this is new territory for me.

The vehicle will certainly remain connected to the "Mothership", regardless of wether the owner has an active subscription or not. The SIM would have what's referred to as "dual billing" capability. This allows the OEM to have a persistent connection for their purposes, with a rate that's negotiated for the entire fleet, while the owner can subscribe to the Rivian Membership to cover their data usage.

 

[PastyPilgrim]

Ah, that'd be too bad if there were a separate network just for usage data. I expect Rivian won't tell us and we'll have to wait for someone to receive a car and dig into it.

 

[photontorque]

@Gator42 , @R_1_T - thanks for the responses, very helpful.

At one point I thought Rivian had said they were going to follow the Apple model in regards to privacy, but I can't remember where I saw / heard that.

Not that Apple is perfect, but I think they are doing things better in regards to privacy than other companies.

Not to get too philosophical, but there are important reasons consumers should care about privacy.

Some interesting articles include:
https://plato.stanford.edu/entries/it-privacy/

https://www.scu.edu/ethics/focus-areas/internet-ethics/resources/why-we-care-about-privacy/


And a quote from the first link is "Informational inequality: Personal data have become commodities. Individuals are usually not in a good position to negotiate contracts about the use of their data and do not have the means to check whether partners live up to the terms of the contract. "

Informational inequality is now a real thing in regards to cell phones and computer/internet related companies. When first computers, and the internet, where "new" technologies, the majority of people and businesses didn't use them, and access to functionality to live in our society didn't depend on them. Now many things exist ONLY online, so if you don't have a computer or a cell phone, you are increasingly boxed out of day-to-day functionality.

The informational inequality / privacy imbalance in this situation is that the relevant company (e.g. cell service, internet provider) can say "you can always choose not to use our service if you don't want personal information collected". Which is fine to say when the service is relevant only to "nice to have things", but it is not fine to say when the service borders on "has to have". Think about all the families whose kids had remote learning during COVID (or maybe still do). They HAVE TO HAVE an internet connection for their child to participate in school. Then their internet provider, or however many layers of 3rd-party s/w providers, is scraping up information about not just the adults, but the kids too.

I fear this is the direction with increasingly connected cars. You can always choose to not buy a car that collects data on every bloody thing you happen to do in and with the car, but what happens when that isn't an option? Now you either hand over all your personal information, or you don't have a car.

I'm surprised that the privacy policy isn't getting more attention. I know everyone has their own personal preferences and hot button topics, but I wonder how much of it is that folks haven't yet considered fully how much Rivian is going to know about you, and that their policy states they can share that with whoever the heck they want.

If RJ really is such a great, aw shucks guy, then he needs to have a sit down with his lawyers and tech team, and rethink their privacy policy. Sure, give people the option to contribute whole hog for those that want to. But for those that DON'T want to, we should be able to opt out. A potential middle ground is to anonymize data.

 

[Zool]

Thanks for posting this. Privacy is the pivotal discussion that very few people want to have.

There was a moment in RJ's round table chat with a bunch of pre-order holders a few weeks ago where he was yammering on about how incredible their camera systems were and how, in conjunction with their 10cm accurate gps, they would be able to map never before seen offroad places and model them google map style...

Which means they will be doing that everywhere, including my private laneway and my secret skinny dipping spot. I had hoped one of those pre-order people would ask RJ about the privacy implications of all that image gathering. There's a hard cut in that section of the video. So maybe someone did.

Of course it isn't just images and facial recognition. Exhaustive, clinical behavioral profiles are being compiled about us every time we interact with anything web connected. If you really want to make yourself crazy, read "The Age of Surveillance Capitalism" and "Privacy Is Power."

I read somewhere (years ago) that you could opt out of all the data collection with Tesla. They just voided your warranty and cut you out of updates.

Right. I'm off to look at pictures of Asian chicks on Instagram – just to trick their algorithms.

 

[R_1_T]

@Gator42 , @R_1_T - thanks for the responses, very helpful.

At one point I thought Rivian had said they were going to follow the Apple model in regards to privacy, but I can't remember where I saw / heard that.

Not that Apple is perfect, but I think they are doing things better in regards to privacy than other companies.

Not to get too philosophical, but there are important reasons consumers should care about privacy.

Some interesting articles include:
https://plato.stanford.edu/entries/it-privacy/

https://www.scu.edu/ethics/focus-areas/internet-ethics/resources/why-we-care-about-privacy/


And a quote from the first link is "Informational inequality: Personal data have become commodities. Individuals are usually not in a good position to negotiate contracts about the use of their data and do not have the means to check whether partners live up to the terms of the contract. "

Informational inequality is now a real thing in regards to cell phones and computer/internet related companies. When first computers, and the internet, where "new" technologies, the majority of people and businesses didn't use them, and access to functionality to live in our society didn't depend on them. Now many things exist ONLY online, so if you don't have a computer or a cell phone, you are increasingly boxed out of day-to-day functionality.

The informational inequality / privacy imbalance in this situation is that the relevant company (e.g. cell service, internet provider) can say "you can always choose not to use our service if you don't want personal information collected". Which is fine to say when the service is relevant only to "nice to have things", but it is not fine to say when the service borders on "has to have". Think about all the families whose kids had remote learning during COVID (or maybe still do). They HAVE TO HAVE an internet connection for their child to participate in school. Then their internet provider, or however many layers of 3rd-party s/w providers, is scraping up information about not just the adults, but the kids too.

I fear this is the direction with increasingly connected cars. You can always choose to not buy a car that collects data on every bloody thing you happen to do in and with the car, but what happens when that isn't an option? Now you either hand over all your personal information, or you don't have a car.

I'm surprised that the privacy policy isn't getting more attention. I know everyone has their own personal preferences and hot button topics, but I wonder how much of it is that folks haven't yet considered fully how much Rivian is going to know about you, and that their policy states they can share that with whoever the heck they want.

If RJ really is such a great, aw shucks guy, then he needs to have a sit down with his lawyers and tech team, and rethink their privacy policy. Sure, give people the option to contribute whole hog for those that want to. But for those that DON'T want to, we should be able to opt out. A potential middle ground is to anonymize data.

Excellent response.
In my opinion, the Amazon connection is the deal RJ made with the devil. I flat out don't trust Amazon. I don't have any Alexa devices, and will likely disconnect the microphone inside my R1T for this reason.

 

[Blueassassin]

Google and Apple already sent all my information to the world and listen to conversations that I have all to send me advertisements I don't want not sure any more harm could be done. I have Alexa in the house and she may be listening in and so is the government along with turning on my security cameras to see in. But they are probably just going to be depressed when they turn on my laptop camera just to see my ugly mug shot.

Anyway a lot of people freak out but unless you want to go live in the mountains away from all technology we already have all our info out there. By the way change your password frequently.

 

[Blueassassin]

RJ stated at the drive event that Alexa was set up as an app BTW so if your not a fan of that it can be turned off completely.

 

[Speedrye]

The privacy policy and the touchscreen-only controls are the only things I have issues with about this vehicle, as they're both bad for my personal safety. If I cancel my order, it will likely be over these two issues.

 

[photontorque]

RJ stated at the drive event that Alexa was set up as an app BTW so if your not a fan of that it can be turned off completely.

Right! What I fear is that Rivian's privacy policy gives them a loop hole big enough for a Blue Origin Shepard rocket -- and a SpaceX falcon 9 for that matter! -- to blast through. Rivian's privacy policy says that they can share your personal information with their business partners, and one obvious business partner is Amazon.

Alexa activated or no, Rivian's privacy policy basically says Rivian can do whatever the heck it wants with all of your personal information. And this is all under a page titled "Rivian is committed to respecting your privacy". Gah.

 

[photontorque]

Google and Apple already sent all my information to the world and listen to conversations that I have all to send me advertisements I don't want not sure any more harm could be done. I have Alexa in the house and she may be listening in and so is the government along with turning on my security cameras to see in. But they are probably just going to be depressed when they turn on my laptop camera just to see my ugly mug shot.

Anyway a lot of people freak out but unless you want to go live in the mountains away from all technology we already have all our info out there. By the way change your password frequently.

Hmmm, well, yes, there is a sense that the genie is out of the bottle, isn't there? I'm hopeful that Humpty Dumpty isn't completely cracked, and we can patch things up.

And part of that patching comes from articulating consumer preference. While I love so many things that the Rivian vehicles can do, I do not appreciate the Rivian company's approach to customer safety and respect when it comes to privacy.

We are individual, human beings who deserve respect, not bags of commercial juice to be sucked on an ongoing basis without regard to impacts such as identity theft.

Riviots, unite! Let Rivian know they should give consumers options for how personal data are collected and distributed.

 

[R_1_T]

Hmmm, well, yes, there is a sense that the genie is out of the bottle, isn't there? I'm hopeful that Humpty Dumpty isn't completely cracked, and we can patch things up.

And part of that patching comes from articulating consumer preference. While I love so many things that the Rivian vehicles can do, I do not appreciate the Rivian company's approach to customer safety and respect when it comes to privacy.

We are individual, human beings who deserve respect, not bags of commercial juice to be sucked on an ongoing basis without regard to impacts such as identity theft.

Riviots, unite! Let Rivian know they should give consumers options for how personal data are collected and distributed.

There should be an ability to Opt out of data collection, and furthermore include the "right to be forgotten". I'd be in favor of GPDR-like data privacy protections.

Sponsored