Many modern cars allow us to stream music, get directions and send messages through the internet, but they can also collect a lot of data about their drivers and where they're going.
One of the world's largest car companies, Toyota, was this week accused of "collecting extensive customer data" and potentially sharing it with third parties, including insurance companies and debt collection agencies.
But Toyota is far from the only car marker to be accused of harvesting and potentially exploiting the data of its customers.
What kinds of data can cars collect?
Dr Katharine Kemp, from the Faculty of Law & Justice at the University of New South Wales, says cars can collect information through features like their cameras, sensors and internet-connected systems, but also from drivers' mobile devices and their dealings with related third parties.
"When consumers attempt to find out how much data is being collected, who it's being shared with and for what purposes, they will find very vague, broadly worded privacy policies that are aimed at giving the car companies permission rather than protecting the consumer," she said.
"I think it's an appalling way to treat consumers, to be providing essentially no privacy choices, and it emphasises that cars are the Wild West of consumer privacy.
"This is a massive problem that governments, including ours, are failing to address."
Queensland man and longtime Toyota customer Mathew told consumer advocacy group CHOICE that he backed out of purchasing a Toyota ute after learning about the data collection behind the company's Connected Services system.
The program's policy document says Toyota collects data for various purposes if drivers don't opt out — including for safety, security, research, product development and data analysis — but the company may also share it with third parties such as finance and insurance companies, debt collection agencies and market research organisations.
"Connected Services operate by using data collected from you and your vehicle, including your personal information, vehicle information and vehicle location," the policy says.
Mathew told the ABC's The World Today he was surprised by what he discovered about the car he paid a deposit for.
"The more I looked into it, the way that Toyota can log into your car remotely, keep a record of all sorts of bits and pieces, and possibly share your driving behaviour with your insurance company — I just thought the whole lot outweighed the benefits," he said.
"It would be really good if you could make it optional. I see some people would probably like [those services], but I think there's an awful lot of people who wouldn't like it."
Rafi Alam from CHOICE told The World Today: "When we looked at Toyota's privacy policy, we found that these Connected Services features will collect data such as fuel levels, odometer readings, vehicle location and driving data, as well as personal information like phone numbers and email addresses."
Toyota Australia says it takes customer privacy "extremely seriously".
In a statement to ABC News, the company said customers could opt out of Connected Services, but that doing so would disable other features including Bluetooth and speaker functionality.
Toyota said removing the SIM card which enables the service would not void a vehicle's warranty, but any work carried out by a non-Toyota technician would not be covered by that warranty.
Other brands fail privacy tests
In 2023, the Mozilla Foundation reviewed the privacy standards of 25 major car brands, including Toyota. All 25 received failing marks for consumer privacy.
The report found brands such as BMW, Ford, Toyota, Tesla, Kia, and Subaru could "collect deeply personal data such as sexual activity, immigration status, race, facial expressions, weight, health and genetic information, and where you drive", which they could potentially sell to third parties.
Nissan was accused of being "the very worst offender", while Toyota was found to have "a near-incomprehensible galaxy of 12 privacy policy documents".
The researchers said they also couldn't confirm whether any of the brands encrypted all of the personal information they stored.
Australia's Federal Chamber of Automotive Industries (FCAI) represents 68 brands which sell vehicles in Australia. The group's voluntary code of conduct on automotive data and privacy protection says its members "understand that the protection and use of this data is a significant responsibility that requires robust systems, policies, and controls".
The code says FCAI members tell their customers about their personal and vehicle information being gathered on a voluntary basis.
The FCAI says this code aligns with Australian laws, but Dr Kemp from UNSW disagrees.
"They say it's a matter of discretion for them to give notice of certain privacy terms to consumers, when in fact it's mandatory for them to give notice of those privacy terms to consumers," she said.
"The car companies really do seem like they're being opportunistic."
Push for Australia to strengthen privacy laws
David Vaile, chairman of the Australian Privacy Foundation, told The World Today that multinational firms collecting and "exploiting" customer data was becoming more common, and Australia needed more robust privacy protections for consumers.
"Over time, we'll need to be thinking more and more carefully about who you're dealing with in buying a car," he said.
"Can you trust them with everything about what you do in the car, what you say in the car, who's in the car, where it goes, your connections to every other online data service?
"If you can't trust them, then maybe you shouldn't be dealing with that particular firm."
Dr Kemp said Australia's privacy laws were "well behind" regulations in other jurisdictions, most notably those in the European Union.
"We've had the Privacy Act review taking place in Australia over the last couple of years, which has now led to the government making some proposals for the reform of our privacy law," she said.
"We might start to see an amending bill later this year for the reform of our privacy law, and amendments are urgently needed.
"Consumer surveys have repeatedly told us that Australian consumers want more control over their personal information, and that privacy matters to them.
"And a big question is — where is the competition on privacy quality between car manufacturers? You just don't see it. Nobody's stepping out there and actually demonstrating that they provide better protections or better privacy choices to consumers."
CHOICE's Mr Alam told the ABC's RN Drive that consumers should be able to have modern connectivity features without car companies sharing their information with third parties.
"If Toyota is very confident in the appeal of these smart features, they should be very clear and explicit to the customer about exactly what they're going to do with this data, rather than asking them to opt out after the fact," he said.
"Consumers deserve that choice."
Loading...