Consumer Rights Wiki - User contributions [en]

Subaru Starlink

2025-11-27T22:34:04Z

IFT294: Cleaned up Starlink formatting

''For the satellite [[internet service provider]], see [[Starlink]].''
{{InfoboxProductLine
| Title = Subaru Starlink
| Release Year = 2013
| Product Type = Software
| In Production = Yes
| Official Website = https://subaru.com/
| Logo = Subaru-starlink.png
}}Starlink is a connectivity service equipped on most modern Subaru vehicles, enabling extensive data collection from the vehicle and its occupants. The service has faced significant criticism and legal challenges over privacy concerns related to its data-collection and -sharing practices.<ref name="MozillaReview" />

==Incidents==

===Obstructive advertising===
Since at least 23-05-25<ref name=":0">{{Cite web |title=Just die already SiriusXM |url=https://www.reddit.com/r/subaru/comments/13rl630/just_die_already_siriusxm/ |access-date=2025-11-27 |website=Reddit}}</ref>, Subaru Starlink will sometimes display whole-screen advertisements for [[SiriusXM]] in vehicles with SiriusXM functionality<ref name=":0" />. Advertisements will display regardless of whether the customer purchased a SiriusXM subscription, and cannot be bypassed without explicitly pressing the close button. Normal system usage, such as GPS, media settings, or driving settings cannot be done until the advertisements are closed.

Users are only able to opt-out of this advertising if they have a SiriusXM subscription, which itself will require consent to additional telemetry from SiriusXM<ref>{{Cite web |date=2025-11-27 |title=SiriusXM Help & Support Center |url=https://listenercare.siriusxm.com/prweb/autoredirect/app/ExternalKM/help/SupportCenter/article/KC-383215/How-do-I-manage-pop-up-messages-inside-my-vehicle%3F |url-status=live}}</ref>. Alternative recourse would involve manually uninstalling the telematics module or pulling the fuse powering the telematics module to disable connectivity. <ref>{{Cite web |date=2025-11-27 |title=No sound in front speakers / Mic is missing (Something with Starlink plugs?) - Resolved {{!}} Subaru Crosstrek and XV Forums |url=https://www.subaruxvforum.com/threads/no-sound-in-front-speakers-mic-is-missing-something-with-starlink-plugs-resolved.180778/ |access-date=2025-11-27 |website=Subaru Crosstrek and XV Forums}}</ref> However, this can disable front audio speakers on certain models due to the fuse powering both Starlink telematics and the front speakers<ref>{{Cite web |date=2020-03-02 |title=Disconnecting your telematics (Starlink) antenna {{!}} Subaru Outback Forums |url=https://www.subaruoutback.org/threads/disconnecting-your-telematics-starlink-antenna.519259/ |access-date=2025-11-27 |website=Subaru Outback Forums}}</ref>.

===Starlink app exploit (''2025'')===
The exploit was achieved by intercepting the Starlink app's network requests which revealed the admin portal login screen. Using the "Reset password" feature of the admin portal which was hidden with javascript the hacker found an employee email off linkedin and successfully managed to login to the admin portal. Although implementing 2FA this too was entirely client-side and the modal window blocking further interaction without verification could also be hidden with javascript.

Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car.

The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01.<ref>{{Cite web |last=Curry |first=Sam |date=23 Jan 2025 |title=Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel |url=https://samcurry.net/hacking-subaru |access-date=2025-02-19 |website=samcurry.net}}</ref>

==Data collection==
===Types of data collected===
Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:<ref name="SubaruPrivacy">{{Cite web |date= |title=Subaru Privacy Policy |url=https://www.subaru.com/support/privacy-policies.html |access-date=2025-01-16 |website=subaru.com}}</ref>

*'''Personal information'''
**Names, addresses, and contact details.
**Phone numbers and email addresses.
**Social-security numbers (in specific cases).
**Driver's license numbers.
**Vehicle identification numbers (VIN).
*'''Vehicle data'''
**Location and GPS coordinates.
**Speed, acceleration, and braking patterns.
**Time and duration of trips.
**Maintenance and diagnostic information.
**Sensor data, such as crash severity, tire pressure, and coolant temperature.
*'''Audio and biometric data'''
**Audio recordings through onboard microphones.
**Voice data from STARLINK service-center calls.
**Biometric data from systems that driver attention.
**Search content and commands issued by occupants.

===Collection methods===
Data collection is performed through:
*Vehicle sensors and diagnostic modules.<ref name="MozillaReview">{{Cite web |last=Mozilla Research |first= |date=15 Aug 2023 |title=Mozilla Foundation Privacy Review: Subaru |url=https://foundation.mozilla.org/en/privacynotincluded/subaru/ |access-date=2025-01-16 |website=foundation.mozilla.org}}</ref>
*GPS tracking systems.
*Cellular-connectivity modules.
*STARLINK mobile apps and web portals.<ref name="MozillaReview" />

==Data sharing and sales==
===Third-party data sharing===
Subaru shares data with several entities, including:
*Data brokers, such as LexisNexis<ref name="SubaruPrivacy" /> and Verisk.<ref name="TorqueNews">{{Cite web |last=Flierl |first=Denis |date=21 May 2024 |title=Vehicle Data Collection Lawsuit |url=https://www.torquenews.com/1084/subaru-now-involved-vehicle-data-collection-lawsuit-investigation |access-date=2025-01-16 |website=torquenews.com}}</ref><ref name="NYT">{{Cite web |last=Hill |first=Kashmir |date=11 March 2024 |title=Automakers Are Sharing Drivers’ Data |url=https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html |access-date=2025-01-16 |website=nytimes.com}}</ref>
*Insurance companies for risk assessment and pricing.<ref name="TorqueNews" />
*Marketing firms.
*Emergency services and law enforcement (when required by law).
*Subaru dealerships and distributors.
*Third-party service providers.<ref name="SubaruPrivacy" />
===Insurance-industry usage===
Data brokers aggregate and sell this information to insurance companies, who may:
*Increase insurance premiums based on driving patterns.
*Monitor driving behaviors to assess risk.
*Use driving data for personalized coverage offerings.<ref name="NYT" />

==Privacy concerns==
===Consent issues===
Key concerns include:
*Simply being a passenger in a STARLINK-equipped vehicle constitutes consent.<ref name="MozillaReview" />
*Lack of active notification during data collection.
*Limited opt-out options that might impact vehicle functionality.

===Difficulties in opting out===
Subaru’s opt-out process involves:
*Submitting detailed personal information.
*Potentially long response times.
*No verification mechanism for successful opt-out.<ref name="ConsumerForum">{{Cite web |date=26 Jan 2025 |title=Privacy Report Discussion |url=https://www.subaruoutback.org/threads/privacy-not-included-subaru-report-connected-services-etc.556583/ |access-date=2025-01-16 |website=subaruoutback.org}}</ref>

===Legal challenges===
Subaru faces legal scrutiny for:
*Allegations of insufficiently disclosing its data-collection policies what it does with data.
*Potential non-compliance with privacy laws.
*[[Class-action lawsuit]] investigations over consent practices.<ref name="TorqueNews" />

==Technical details==
===System architecture===
STARLINK is built upon:
*Embedded telematics devices.
*4G LTE cellular networks.
*GPS receivers and cloud-based data-processing systems.<ref name="StarlinkTerms">{{Cite web |title=Subaru STARLINK Terms and Conditions |url=https://www.subaru.com/support/terms-and-conditions/subaru-starlink/subaru-starlink-services.html |access-date=2025-01-16 |website=subaru.com}}</ref>

===Data transmission===
*Real-time data transmission through LTE networks.
*Local storage when connectivity is unavailable.<ref name="StarlinkTerms" />

==Consumer-protection issues==
===Privacy rights===
Critics cite:
*Minimal control over data retention.
*Broad sharing permissions in privacy policies.
*Limited transparency about how data is used.<ref name="MozillaReview" />

===Economic harm===
*Insurance-rate adjustments based on driving data.
*Subscription fees for connected services.
*Potential effects on vehicle resale value.<ref name="NYT" />

==References==
<references />

[[Category:{{PAGENAME}}]]

Subaru Starlink

2025-11-27T22:32:54Z

IFT294: Rearranged Starlink app exploit into a new Incidents section, and added a section for obstructive advertising. Sourcing is not ideal, primarily using forums. I do have personal experience with the issue in this new section, so cleaning up would be appreciated to ensure this is as objective as possible.

''For the satellite [[internet service provider]], see [[Starlink]].''
{{InfoboxProductLine
| Title = Subaru Starlink
| Release Year = 2013
| Product Type = Software
| In Production = Yes
| Official Website = https://subaru.com/
| Logo = Subaru-starlink.png
}}Starlink is a connectivity service equipped on most modern Subaru vehicles, enabling extensive data collection from the vehicle and its occupants. The service has faced significant criticism and legal challenges over privacy concerns related to its data-collection and -sharing practices.<ref name="MozillaReview" />

== Incidents ==

=== Obstructive advertising ===
Since at least 23-05-25<ref name=":0">{{Cite web |title=Just die already SiriusXM |url=https://www.reddit.com/r/subaru/comments/13rl630/just_die_already_siriusxm/ |access-date=2025-11-27 |website=Reddit}}</ref>, Subaru STARLINK will sometimes display whole-screen advertisements for [[SiriusXM]] in vehicles with SiriusXM functionality<ref name=":0" />. Advertisements will display regardless of whether the customer purchased a SiriusXM subscription, and cannot be bypassed without explicitly pressing the close button. Normal system usage, such as GPS, media settings, or driving settings cannot be done until the advertisements are closed.

Users are only able to opt-out of this advertising if they have a SiriusXM subscription, which itself will require consent to additional telemetry from SiriusXM<ref>{{Cite web |date=2025-11-27 |title=SiriusXM Help & Support Center |url=https://listenercare.siriusxm.com/prweb/autoredirect/app/ExternalKM/help/SupportCenter/article/KC-383215/How-do-I-manage-pop-up-messages-inside-my-vehicle%3F |url-status=live}}</ref>. Alternative recourse would involve manually uninstalling the telematics module or pulling the fuse powering the telematics module to disable connectivity. <ref>{{Cite web |date=2025-11-27 |title=No sound in front speakers / Mic is missing (Something with Starlink plugs?) - Resolved {{!}} Subaru Crosstrek and XV Forums |url=https://www.subaruxvforum.com/threads/no-sound-in-front-speakers-mic-is-missing-something-with-starlink-plugs-resolved.180778/ |access-date=2025-11-27 |website=Subaru Crosstrek and XV Forums}}</ref> However, this can disable front audio speakers on certain models due to the fuse powering both STARLINK telematics and the front speakers<ref>{{Cite web |date=2020-03-02 |title=Disconnecting your telematics (Starlink) antenna {{!}} Subaru Outback Forums |url=https://www.subaruoutback.org/threads/disconnecting-your-telematics-starlink-antenna.519259/ |access-date=2025-11-27 |website=Subaru Outback Forums}}</ref>.

===Starlink app exploit (''2025'')===
The exploit was achieved by intercepting the Starlink app's network requests which revealed the admin portal login screen. Using the "Reset password" feature of the admin portal which was hidden with javascript the hacker found an employee email off linkedin and successfully managed to login to the admin portal. Although implementing 2FA this too was entirely client-side and the modal window blocking further interaction without verification could also be hidden with javascript.

Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car.

The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01.<ref>{{Cite web |last=Curry |first=Sam |date=23 Jan 2025 |title=Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel |url=https://samcurry.net/hacking-subaru |access-date=2025-02-19 |website=samcurry.net}}</ref>

==Data collection==
===Types of data collected===
Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:<ref name="SubaruPrivacy">{{Cite web |date= |title=Subaru Privacy Policy |url=https://www.subaru.com/support/privacy-policies.html |access-date=2025-01-16 |website=subaru.com}}</ref>

*'''Personal information'''
**Names, addresses, and contact details.
**Phone numbers and email addresses.
**Social-security numbers (in specific cases).
**Driver's license numbers.
**Vehicle identification numbers (VIN).
*'''Vehicle data'''
**Location and GPS coordinates.
**Speed, acceleration, and braking patterns.
**Time and duration of trips.
**Maintenance and diagnostic information.
**Sensor data, such as crash severity, tire pressure, and coolant temperature.
*'''Audio and biometric data'''
**Audio recordings through onboard microphones.
**Voice data from STARLINK service-center calls.
**Biometric data from systems that driver attention.
**Search content and commands issued by occupants.

===Collection methods===
Data collection is performed through:
*Vehicle sensors and diagnostic modules.<ref name="MozillaReview">{{Cite web |last=Mozilla Research |first= |date=15 Aug 2023 |title=Mozilla Foundation Privacy Review: Subaru |url=https://foundation.mozilla.org/en/privacynotincluded/subaru/ |access-date=2025-01-16 |website=foundation.mozilla.org}}</ref>
*GPS tracking systems.
*Cellular-connectivity modules.
*STARLINK mobile apps and web portals.<ref name="MozillaReview" />

==Data sharing and sales==
===Third-party data sharing===
Subaru shares data with several entities, including:
*Data brokers, such as LexisNexis<ref name="SubaruPrivacy" /> and Verisk.<ref name="TorqueNews">{{Cite web |last=Flierl |first=Denis |date=21 May 2024 |title=Vehicle Data Collection Lawsuit |url=https://www.torquenews.com/1084/subaru-now-involved-vehicle-data-collection-lawsuit-investigation |access-date=2025-01-16 |website=torquenews.com}}</ref><ref name="NYT">{{Cite web |last=Hill |first=Kashmir |date=11 March 2024 |title=Automakers Are Sharing Drivers’ Data |url=https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html |access-date=2025-01-16 |website=nytimes.com}}</ref>
*Insurance companies for risk assessment and pricing.<ref name="TorqueNews" />
*Marketing firms.
*Emergency services and law enforcement (when required by law).
*Subaru dealerships and distributors.
*Third-party service providers.<ref name="SubaruPrivacy" />
===Insurance-industry usage===
Data brokers aggregate and sell this information to insurance companies, who may:
*Increase insurance premiums based on driving patterns.
*Monitor driving behaviors to assess risk.
*Use driving data for personalized coverage offerings.<ref name="NYT" />

==Privacy concerns==
===Consent issues===
Key concerns include:
*Simply being a passenger in a STARLINK-equipped vehicle constitutes consent.<ref name="MozillaReview" />
*Lack of active notification during data collection.
*Limited opt-out options that might impact vehicle functionality.

===Difficulties in opting out===
Subaru’s opt-out process involves:
*Submitting detailed personal information.
*Potentially long response times.
*No verification mechanism for successful opt-out.<ref name="ConsumerForum">{{Cite web |date=26 Jan 2025 |title=Privacy Report Discussion |url=https://www.subaruoutback.org/threads/privacy-not-included-subaru-report-connected-services-etc.556583/ |access-date=2025-01-16 |website=subaruoutback.org}}</ref>

===Legal challenges===
Subaru faces legal scrutiny for:
*Allegations of insufficiently disclosing its data-collection policies what it does with data.
*Potential non-compliance with privacy laws.
*[[Class-action lawsuit]] investigations over consent practices.<ref name="TorqueNews" />

==Technical details==
===System architecture===
STARLINK is built upon:
*Embedded telematics devices.
*4G LTE cellular networks.
*GPS receivers and cloud-based data-processing systems.<ref name="StarlinkTerms">{{Cite web |title=Subaru STARLINK Terms and Conditions |url=https://www.subaru.com/support/terms-and-conditions/subaru-starlink/subaru-starlink-services.html |access-date=2025-01-16 |website=subaru.com}}</ref>

===Data transmission===
*Real-time data transmission through LTE networks.
*Local storage when connectivity is unavailable.<ref name="StarlinkTerms" />

==Consumer-protection issues==
===Privacy rights===
Critics cite:
*Minimal control over data retention.
*Broad sharing permissions in privacy policies.
*Limited transparency about how data is used.<ref name="MozillaReview" />

===Economic harm===
*Insurance-rate adjustments based on driving data.
*Subscription fees for connected services.
*Potential effects on vehicle resale value.<ref name="NYT" />

==References==
<references />

[[Category:{{PAGENAME}}]]