Choice, a consumer advocacy organization, recently analyzed the privacy policies of car manufacturers to understand how today’s increasingly digital vehicles collect and share data. Their findings indicate that several major car brands in Australia are gathering a range of driver data, including, in some cases, video and biometric information, which is then shared with third parties.
“We looked into the privacy policies of several leading manufacturers like Toyota, Ford, MG, Mazda, Kia, Hyundai, Tesla, Subaru, Isuzu, and Mitsubishi,” said Rafi Alam from Choice. “Our analysis revealed that Kia, Hyundai, and Tesla are the least protective when it comes to customer privacy. For instance, both Kia and Hyundai collect and share voice recognition data, along with other information, with third parties.”
Alam added, “Tesla goes even further by collecting short video clips and images from the vehicle’s internal cameras, also sharing this data.”
The investigation found that while Toyota, Ford, MG, and Mazda do collect customer data, brands such as Mitsubishi, Subaru, and Isuzu do not engage in any data collection or sharing.
In light of these findings, Guardian Australia reached out to Kia, Hyundai, and Tesla for comments. A spokesperson from Hyundai explained that their Bluelink app collects data in two ways: through in-vehicle activation for functions like automatic collision notifications and voice recognition, and by having users fully enroll via the app, linking their email and phone number to create an account. They assured customers that they can deactivate data collection features, and if a Bluelink account is deleted, all associated data is erased.
Hyundai also noted that the voice recognition data is collected in an aggregate, non-identifiable manner for sharing with Cerence, a third-party provider specializing in automotive voice and AI products. The shared data is aimed at enhancing customer service, personalizing the user experience, evaluating service quality, and conducting targeted marketing with user consent.
Tesla did not provide a direct response but stated in their privacy policy that the company does not sell user data. Information may be shared with affiliates, service providers, and authorized third parties, as well as law enforcement when necessary. Tesla collects data about speed, battery usage, and camera images but does not link location data to user accounts and allows customers to opt out of data collection via the vehicle’s touchscreen.
Kia, which is a subsidiary of Hyundai, pointed to its own privacy policy, explaining that its voice recognition data is also shared with the same third-party provider. Kia Connect gathers location data, which is provided in pseudonymous form to Here, a real-time traffic information service. However, even if customers choose to opt out of location-sharing, GPS data is still collected for other Kia Connect services.
Choice highlighted that while companies offer options to opt out of data collection, many customers may not be aware that their data is being gathered. Alam expressed concern that businesses often feel pressured to collect extensive data, sometimes without clear intentions for its use.
“When it comes to cars, we’ve found that a combination of new and old technology creates features that may feel intrusive,” he said. “We want consumers to have greater control, and we urge the law to ensure transparency and fairness in how their data is used.”
Alam stressed the need for the federal government to act on the recommendations from the review of the Privacy Act to improve public control over personal information collection and usage. “Our findings serve as a clear reminder that Australia’s privacy laws are outdated and inadequate for a market where vehicles are collecting and sharing personal data in large volumes,” he concluded.
