Experts Demand Privacy Act Overhaul as Car Brands Harvest Driver Data

Seven of Australia's ten best-selling car brands are harvesting driver data through connected vehicle services, with some sharing personal information with third parties for advertising and AI development, according to an investigation by CHOICE magazine.

Cybersecurity experts are calling for immediate amendments to the Privacy Act, arguing that current regulations leave motorists vulnerable to unprecedented surveillance.

Data Collection Widespread Among Top Brands

Toyota and Ford confirmed they collect and share driver data with third-party providers, though Ford states it does not sell information to data brokers. Mazda collects driving patterns and voice consumption data, sharing it with third parties for advertising purposes.

Hyundai and Kia share voice recognition data with Cerence, a US-based artificial intelligence firm. Tesla collects voice recognition data alongside videos and images from onboard cameras, sharing some information with third parties.

'Totally Unacceptable', Expert Says

Dr Vanessa Teague of the Australian National University condemned the practices as fundamentally incompatible with Australian privacy expectations.

"What these car companies are doing is totally unacceptable. It should be illegal," Dr Teague said. "These practices are good evidence that we need the Privacy Act updated or the Privacy Act enforced, because none of this should be acceptable in our country."

Dr Teague argued that the current opt-out consent model is inadequate, calling for a shift to opt-in requirements for data collection features.

"Opt-out is not the answer; you should have to opt-in to some of these features if you want them," she said.

Global Context, Local Gaps

The Australian investigation mirrors concerns emerging internationally. In the United States, Hyundai and Kia face lawsuits alleging violations of the Fair Credit Reporting Act through data sales that influenced insurance premiums.

Experts warn that vehicle telemetry, location tracking and biometric data collection have transformed modern cars into mobile technology hubs, yet Australian law lacks specific automotive data protections.

Privacy advocates argue that claims of data de-identification are misleading, particularly for voice and image data that can be readily re-identified. The absence of sector-specific regulations means consumers have limited recourse when manufacturers monetise their movements and conversations.

The CHOICE investigation found that connected services are increasingly standard across new vehicles, meaning data collection affects a growing proportion of Australian drivers regardless of whether they understand the privacy implications.