Google Gemini in Android Auto Logs Driving Data and Voice, Raising Privacy Risks for In‑Car Users
What Happened — Google has integrated its Gemini generative‑AI assistant into Android Auto as the default voice interface. Gemini continuously records ambient audio for wake‑word detection and logs location, call history, texts and contacts that pass through the car’s infotainment bridge. Users cannot fully disable Gemini in Android Auto, only limit its access via settings.
Why It Matters for Compliance & Audit Readiness
- The scenario exemplifies a privacy‑control gap that SOC 2 CC5.2 (Privacy) and CC6.1 (System and Communications Protection) are designed to detect, document, and remediate.
- Continuous evidence of consent management, data‑minimization settings, and DSAR readiness is required to demonstrate “reasonable” privacy safeguards to auditors.
- Verisq’s CookiePLUS capability can provide the audit‑ready consent logs and DSAR workflow evidence needed to prove compliance with GDPR, CCPA, and SOC 2 privacy criteria.
Who Is Affected
- Automotive OEMs and Tier‑1 suppliers that embed Android Auto in vehicles.
- Fleet‑management operators that provision employee devices for in‑car use.
- Enterprise IT teams managing corporate‑issued Android phones used with Android Auto.
Recommended Actions
- Conduct a privacy impact assessment (PIA) for any Android Auto deployment that includes Gemini.
- Map the Gemini data‑collection settings to SOC 2 CC5.2 controls (e.g., “Data Minimization” and “User Consent”).
- Capture screenshots or configuration exports as continuous audit evidence of the applied settings.
- Update privacy policies and DSAR processes to cover in‑car voice and location data.
- Deploy a consent‑management solution (e.g., Verisq CookiePLUS) to record user opt‑in/opt‑out choices and automate DSAR fulfillment.
Technical Notes – Gemini uses an always‑on microphone for “Hey Google” detection; audio is streamed to Google only after the wake word activates, and non‑triggered recordings are deleted automatically. By default, Android Auto grants Gemini access to call logs, SMS, contacts, and precise GPS location. Settings can be toggled in the “Gemini Apps Activity” and Android Auto permission menus, but the assistant cannot be completely removed from the car interface.
Source: ZDNet Security – Stop Gemini from Listening in Android Auto