Toyota and Hyundai under investigation over connected-car data privacy

Toyota and Hyundai are being investigated by the Office of the Australian Information Commissioner (OAIC) over potential breaches of Australia's privacy laws, including how they collect, use and obtain consent for customers' personal data.

Choice reports the two automakers are being investigated by Privacy Commissioner Carly Kind, after she told federal parliament earlier this year the OAIC was investigating two brands "from Asia".

Toyota is Australia's best-selling automotive brand and has held the top spot for more than two decades, while Hyundai – which celebrates its 40th anniversary in Australia this month – placed fifth overall in 2025.

While Toyota declined to comment on the investigation, its latest Connected Services Privacy Policy states: "Toyota's intention is to provide our customers with the highest level of transparency, peace of mind and confidentiality in data privacy at all times.

"In doing so we endeavour to further the trust and reliability associated with Toyota through responsible data governance while enhancing products, services and experiences for our customers."

Similarly, a Hyundai spokesperson told Choice: "Hyundai takes privacy and data protection seriously."

The investigation is expected to take up to 18 months, depending on its findings, and will centre on three key areas.

The first is whether the two automakers are collecting personal information beyond what is necessary to operate the vehicle and its connected services.

The second is whether customer data is being shared with third parties, including sales and marketing organisations, without the vehicle owner's consent.

The third is whether the companies are complying with their obligations to destroy or de-identify personal information once it is no longer required.

The investigation comes as an increasing number of vehicles become available with connected tech, including electric vehicles (EVs) as well as petrol, diesel and hybrid models.

A connected car is a vehicle with built-in internet connectivity that enables it to send and receive data for functions including live traffic navigation, remote climate control, over-the-air software updates and emergency (eCall) services following a collision.

The technology first appeared in a mass-produced vehicle in 1996, when General Motors' OnStar connected services system debuted in the Cadillac DeVille, Eldorado and Seville.

A simplified version of the technology arrived in Australia in 2001 as Holden Assist, fitted to Holden's Statesman and Caprice luxury sedans.

The Toyota Yaris Cross was the Japanese giant's first local model to offer Toyota Connected Services, in 2020, bringing emergency assistance and stolen vehicle tracking.

The 2023 model year Hyundai Palisade became the Korean brand's first Australian model to feature Bluelink connected-car services when it arrived in August 2022.

A 2024 Choice investigation of connected-car privacy across 10 vehicle brands ranked Toyota mid-pack, while describing Hyundai as among the "most concerning" brands for data privacy.

In late July, the Australian Electric Vehicle Association (AEVA) called on the federal government to strengthen Australia's connected vehicle data laws, arguing the current framework, based on privacy legislation dating back to 1988, is no longer fit for purpose.

"With the expectation that 95 per cent of all new vehicles, including electric vehicles, sold in Australia by 2035 will be internet-enabled, consumer protection and national security risks will likely escalate without intervention," the AEVA said.

The Australian Government has already passed the first tranche of broader privacy reforms in 2024, but is yet to introduce the second tranche, which is expected to include stronger consent requirements, a broader definition of personal information, and a right to erasure.

"Australians want their privacy respected. When Australians are asked to hand over their personal data, they expect it will be protected," a spokesperson for Attorney-General Michelle Rowland told Choice.

"The government continues to work carefully to ensure these reforms are workable and in the best interests of Australians."

There have been various controversies surrounding connected cars in recent years.

In 2024, GM was accused of gathering customers' driving data and selling it on without their consent, and earlier this year was banned by the US Federal Trade Commission from supplying geolocation and driver behaviour data to consumer reporting organisations without consent for five years.

The US Government cited national security concerns in blocking Chinese connected vehicle technology, and banned Polestar under its Connected Vehicle Rule earlier this year.

In August 2025, Israel barred Chinese-made vehicles from its military bases, amid concerns their onboard cameras and sensors could expose sensitive information. Subsequently, in February 2026, Poland barred Chinese-made vehicles from its military facilities.

MORE: Australian Government urged to tighten connected-car data laws