A recent investigation by the consumer advocacy group Choice has uncovered alarming levels of personal information being tracked and shared with third-party companies by top car brands in Australia.
Among the brands investigated, Kia and Hyundai were highlighted as the biggest offenders, collecting and sharing voice recognition data with Cerence, a U.S.-based AI company. Tesla was also found to collect voice and video data from its onboard cameras, though it claims to implement privacy-preserving techniques that anonymize this information.
Toyota, Australia’s leading carmaker, gathers detailed vehicle location data and driving behavior metrics through its Drive Pulse feature, which tracks acceleration, braking, and cornering during trips. This data is shared with Toyota’s related companies and third-party service providers. Other carmakers, including Ford, MG, and Mazda, admitted to collecting and sharing various forms of data, though Choice found vague responses from some brands about the specifics of what is being shared.
In contrast, brands such as Mitsubishi, Subaru, and Isuzu Ute stated that they do not collect or share any driver data in Australia.
Experts argue that the collection and sharing of such sensitive data without explicit consent violates privacy rights. Dr. Vanessa Teague from the Australian National University criticized the practice, labeling it “totally unacceptable” and calling for it to be made illegal. She emphasized that drivers often unknowingly opt into these data collection features when they purchase the vehicle or download its associated app. “Opt-out is not the solution,” Teague stated.
“You should have to opt-in to some of these features if you want them. Many of these other features should simply be illegal.”
Professor Ibrahim Khalil from RMIT University also raised concerns about how Australian drivers’ raw data is being transferred to overseas companies. He pointed out that AI systems can analyze driving data locally within the car without needing to send raw information to external entities, a practice that could limit the risk of privacy breaches.
Many of the connected features in modern cars, such as navigation, weather updates, and emergency SOS systems, are tied to data collection. Disabling these features to protect one’s privacy may result in a loss of functionality or even void part of the car’s warranty, as in the case of Toyota.
Under Australia’s Privacy Act, sensitive data, such as voice recognition, should require enhanced levels of consumer protection and explicit consent before it can be collected or shared.
Choice has called for reforms to ensure that companies adhere to stricter privacy protections, similar to what is already in place in regions like Europe.