- with Senior Company Executives, HR and Finance and Tax Executives
- in United States
- with readers working within the Advertising & Public Relations, Business & Consumer Services and Insurance industries
The automotive sector sits at the intersection of in-person data collection, connected technology, cross-border flows and increasingly, national security concerns.
Connected vehicles collect potentially thousands of data points each time they’re on the road, and are expected to account for 93% of new car sales in Australia by 2031 and sustained regulatory attention seems inevitable.1
In January 2026, the Office of the Australian Information Commissioner (OAIC) launched its first privacy compliance sweep, targeting businesses that collect personal information in person. Car dealerships were among the six sectors selected, with the OAIC assessing whether their privacy policies meet transparency obligations under the Privacy Act 1988 (Cth) (Privacy Act).
Combined with Privacy Commissioner Carly Kind’s public remarks on connected vehicle data, the message to manufacturers, dealers and fleet operators is clear: this is no test drive. The OAIC is shifting into a higher gear, and the automotive industry can no longer afford to treat privacy compliance as a back-office concern.
Below, we discuss what the sweep covered, what it means for dealerships, and why the broader connected vehicle privacy landscape, including the complex regulatory and reputational challenges facing EV manufacturers, importers and dealers operating in Australia, demands immediate attention from industry participants.
What the privacy compliance sweep covered
The privacy compliance sweep assessed approximately 60 entities across six sectors, which were selected for the particular privacy risks associated with in-person collection of personal identification documents and prior data breaches in the sector. Entities were chosen by reference to size, location, public profile and prior breach history.
The sweep primarily assessed the entities compliance against Australian Privacy Principle (APP) 1.4, which requires entities to manage personal information transparently and maintain a clearly expressed, up-to-date privacy policy and implementing the systems needed to comply. The OAIC has recently updated its APP 1 guidance and signalled a broader ambition: prompting industry to reflect on whether enough is actually being done.
For the automotive sector, OAIC scrutiny extends beyond the technical adequacy of a privacy policy. The sweep signals examination of the entire personal information life cycle – from test drive and finance to aftersales service.
What it means for automotive dealerships
For car dealerships, the exposure is immediate. Test drive forms, digital enquiries, finance applications and aftersales records all involve collecting personal information. APP 1.4 requires your privacy policy to accurately describe each of these practices: what is collected, how and why, how it is held, and how individuals can access or correct it.
A policy that is silent on, or inconsistent with, your actual data practices is non-compliant on its face, and this is precisely the gap the OAIC is now actively looking for.
The regulatory stakes are significant. 2024 amendments to the Privacy Act expanded consequences for breaches of core obligations, including failure to maintain a compliant privacy policy. Entities may face infringement notices and civil penalties of up to $66,000 (200 penalty units). The OAIC has signalled it will apply its expanded regulatory toolkit where non-compliance is detected.
Beyond compliance, there is a commercial case. OAIC research shows Australians rank privacy just below quality and price when choosing products or services, and customers increasingly factor privacy into purchasing decisions. A transparent, accurate privacy policy signals that their data is in safe hands. Dealerships that treat the sweep as an opportunity and not just a risk to manage are better placed to earn and retain customer trust in a market where data confidence is a competitive differentiator.
Connected vehicles | The larger industry problem
The sweep is, however, only a visible edge of a much larger issue. In February 2026, Commissioner Kind confirmed at Senate that the OAIC had two active investigations into Asia-based car manufacturers over potential breaches of privacy laws relating to connected vehicles.
Modern connected vehicles collect data at a scale most buyers, drivers and dealers do not fully appreciate. Cameras, sensors, infotainment systems, GPS and driving behaviour analytics generate continuous data streams — much of it personal information under the Privacy Act, some of it sensitive. This can include vehicle telemetry, location history, voice data, camera footage (including of people outside the vehicle), and data drawn from connected phones and apps.
Already in May 2025, Commissioner Kind delivered an assessment of the connected vehicle privacy landscape at the NSW Privacy & Security Regulation for Connected Cars Workshop. The table below summarises the key themes raised by Commissioner Kind.
| Theme | Key concerns |
| Transparency | Only two in ten Australian drivers are aware their vehicle transmits data to the manufacturer. Consumers would need to read on average nearly 14,000 words across multiple documents (close to an hour of reading) to uncover a single brand’s privacy terms, which are often dense and of limited practical use. OAIC research shows 87% of Australians consider it unreasonable to be tracked where no location-based service is provided, and 84% support location tracking being switched off by default for children. Where consumers cannot understand how their data is handled, meaningful consent becomes a fiction. |
| Control | Consumers are opted in to connected features by default at purchase or when downloading the vehicle’s app. Opting out is often difficult or impossible, and in some cases disabling data collection disables core vehicle functions or voids warranties. |
| Proportionality | Concerns about the sheer volume of data collected and whether collection is reasonably necessary, particularly where sensors operate continuously and automatically regardless of a user’s preferences. |
| Security and misuse | Overcollection creates vulnerability to malicious actors and exploitation of remote vehicle functions. Documented cases of alleged perpetrators of domestic violence using connected services to track former partners. The Commissioner referenced the US Federal Trade Commission’s action against General Motors and OnStar over allegations that geolocation and driving behaviour data was sold to consumer reporting agencies, which then supplied information used by insurers to deny coverage or set rates. Tesla employees reportedly shared sensitive footage captured by customer vehicles. |
| Supply chain accountability | Vehicles are shared, sold, passed between drivers, and provided as fleet or company vehicles, creating complex questions about who bears responsibility for privacy compliance and whether every occupant (including passengers and children) is adequately protected. |
APP obligations in practice for connected vehicles
So, what are the privacy obligations for connected vehicle businesses? The APPs impose layered obligations that demand more than just a compliant privacy policy.
APP 1 and APP 5 address transparency. APP 1 requires a clearly expressed, up-to-date privacy policy; APP 5 requires notification at or before collection. For connected vehicles, where data collection starts the moment the engine turns, burying disclosure in lengthy terms is not sufficient. Policies and notices must be accessible, written in plain language, and accurate as to what is collected, why and to whom it is disclosed.
APP 3 requires that personal information be collected only where reasonably necessary, and by lawful and fair means. The continuous, automatic collection of sensor, location, biometric and behavioural data raises an immediate question: is this genuinely necessary? The Commissioner’s emphasis on proportionality signals that “we collect it because we can” will not be a satisfactory answer. Proposed reforms would introduce an overarching objective standard requiring that collection, use and disclosure be fair and reasonable, regardless of whether consent has been obtained.
APP 6 limits secondary use and disclosure. Where connected vehicle data flows to third parties, such as insurers, consumer reporting agencies, AI training companies, businesses must understand and document the legal basis. Where consent is relied upon, it must be meaningful: default opt-ins and bundled terms will not suffice.
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. The security risks identified by the Commissioner point to potential gaps. Businesses should review retention practices and consider what happens to connected vehicle data when a car is sold, returned from lease, or transferred within a fleet.
AI and automated decision-making. As outlined in our previous article, the OAIC’s October 2024 guidance confirmed that personal information used in AI systems remains subject to all APP obligations. Explicit consent will typically be required for AI-related uses such as model training and this is not a theoretical concern: Choice’s research2 found that certain connected car manufacturers collected voice recognition data and sold it to an AI software training company without adequate disclosure.
From 10 December 2026, new APP 1.7 will require entities to disclose in their privacy policies where personal information is used in automated decisions that could significantly affect an individual’s rights or interests, including the kinds of personal information used and the kinds of decisions made. Connected vehicle businesses generating behavioural profiles, credit data or driver risk assessments should factor these requirements into current system design and governance frameworks.
The automotive supply chain adds further complexity. Dealers, fleet managers and rental companies may be facilitating ongoing data collection by manufacturer systems without appreciating their own Privacy Act obligations. A dealership handing over a connected vehicle may have no visibility into what is collected, where it is sent, or how long it is retained, yet it may still be an APP entity with compliance obligations across the full suite of APPs. The same applies to fleet managers whose employees and contractors are exposed to undisclosed data collection. Businesses should also note that the OAIC is developing a Children’s Online Privacy Code that will impose a higher level of privacy requirements for online services accessed by children which could extend to connected car entertainment systems and voice assistants. Control of data infrastructure sits with the manufacturer; however, Privacy Act obligations do not.
For EV manufacturers importing vehicles into Australia, and for the dealerships and distributors selling them, proactive engagement with Privacy Act compliance is both a legal necessity and the most effective response to these challenges.
Manufacturers, importers and dealers that invest in robust Australian privacy compliance, including clear cross-border disclosure frameworks and meaningful consent mechanisms, are well placed to build consumer trust and demonstrate regulatory accountability in a market where scrutiny is only increasing.
What businesses should do now
The January sweep targeted privacy policies in the automotive industry is a starting point of the journey to regulation. In March 2026, the OAIC signalled a shift towards proactive enforcement, including Commissioner-initiated investigations into connected cars. The next phase will go further, and now is the time to act. Priority steps include:
Audit your data flows. Map collection across the full customer journey, from enquiry, test drive, purchase, finance, vehicle operation to post-sale. This should including offshore transmission by the vehicle itself.
Fix your policies and notices. Review privacy policies against APP 1.4 and collection notices against APP 5. If they do not accurately describe what is collected, why, and to whom it flows, they are non-compliant.
Get consent right. Consent for secondary uses, including insurers, AI training, cross-border disclosure, must be explicit and granular, not buried in bundled terms or default opt-ins.
Train your people. Staff handling in-person collection must understand their obligation to inform customers about data practices at the point of collection.
Prepare for APP 1.7. From 10 December 2026, entities must disclose automated decision-making in their privacy policies. Connected vehicle businesses generating behavioural profiles or driver risk assessments should be designing for this now.
For EV importers: go further. Map precisely what data the vehicle collects and where it is transmitted, identify constraints under applicable foreign laws, build cross-border disclosure frameworks supporting APP 8 compliance, and engage proactively with Australian regulators. Addressing these challenges early is far more effective than responding after they crystallise.
How we can help
Our privacy and data protection team regularly advises businesses in the automotive industry on Privacy Act compliance, privacy policy drafting and data governance, including EV manufacturers, importers and dealers navigating the Australian regulatory environment.
Footnote
1. Austroads, Future Vehicles Forecasts Update 2031: Addendum to Future Vehicles 2030, Research Report No. AP-R654-21, 6 September 2021, pp. 28–29.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
