8 car brands whose privacy policies and practices let them collect the most about drivers

Automakers now build rolling data platforms as much as cars, and their own privacy policies spell out how far that reach extends. Mozilla’s review of major brands found practices ranging from tracking seatbelt habits to collecting details about a driver’s sex life. Here are eight car brands whose policies and practices let them collect the most about drivers.

1. Nissan: The Broadest Data Grab

Mozilla’s 2023 privacy policy review found Nissan’s own terms allow the company to collect data on drivers’ sexual activity, health diagnoses and genetic information, categories the nonprofit said sat among the most invasive it found while testing 25 major automakers, all of which failed its privacy standards.

The same policy lets Nissan share psychological and behavioral inferences drawn from that data with outside third parties, so a profile built from sensor, app and service records can travel well beyond the dealership before a driver ever learns what conclusions were drawn about them. Because the policy does not name every recipient in advance, owners have no simple way to check which insurers, advertisers or other partners eventually receive it.

2. Kia: Sex Life On The Books

Kia’s own privacy policy states plainly that the company can collect information about a driver’s “sex life,” language Mozilla flagged as unusually explicit among the 25 major brands its 2023 review covered.

The policy does not explain why a car needs that category of data, and Kia’s broader terms give it wide latitude to bundle it with location history and driving-behavior records collected through the vehicle’s connected infotainment and app systems, with no separate consent required. It is the sort of clause that becomes visible only to a driver willing to read a dense privacy policy line by line, rather than one flagged at the dealership.

3. Hyundai: Handing Data To Police

Hyundai’s privacy policy permits the company to share driver data with law enforcement and governments based on nothing more than a “formal or informal” request, with no subpoena, warrant or court order required first.

That framing means police access to a driver’s location and trip history can hinge on an email rather than a legal process, leaving drivers dependent entirely on Hyundai’s own internal discretion for what gets handed over and when. Compared with policies that require a warrant before sharing location or trip data, Hyundai’s language sets a notably lower bar for what an outside agency needs to provide before getting access.

4. Volkswagen: Braking Habits Tracked

Volkswagen’s privacy policy collects driving behaviors such as a driver’s seatbelt use and braking habits, then pairs that moment-to-moment behavioral data with demographic details including age and gender.

Combining habit-level driving data with demographics lets VW or its partners build a far fuller behavioral profile than raw trip logs alone would allow, extending well past what actually running or servicing the car requires. That kind of layered profile is exactly what advertisers and data brokers pay to access, even though hard braking at a stop sign has nothing to do with keeping the vehicle itself on the road.

5. Subaru: Passengers Count As Users

Subaru’s policy treats anyone riding along, not just the registered owner, as a “user” who has consented to its data collection simply by being inside the vehicle.

That means a passenger who never signed anything, opened an app or agreed to any terms is still covered by Subaru’s data-sharing language, with no separate notice, prompt or opt-out offered once they take a seat in someone else’s car. Nothing in the policy describes a way for that passenger to decline, since consent there is tied to the act of riding along rather than to any signature or click.

6. Toyota: Twelve Overlapping Policies

Toyota spreads its data practices across a “constellation of 12 different privacy policies,” according to Mozilla’s review, rather than one document a driver could reasonably sit down and read.

Splitting disclosures across a dozen separate policies makes it functionally difficult for an owner to piece together what Toyota actually collects across the vehicle, the app and connected services, a structure Mozilla singled out as an obstacle to informed consent. A driver who wants to exercise a right to opt out or delete data would first need to identify which of the twelve policies actually covers that particular system.

7. Chevrolet: Sold Straight To Insurers

General Motors shared Chevrolet drivers’ data through its Smart Driver program with brokers who sold it to insurers, who in turn used the driving records to help set individual policy rates.

GM eventually killed the program after the practice drew public scrutiny, but it had already funneled real driving data from enrolled Chevrolet vehicles into the insurance-pricing pipeline before most drivers realized the connection existed. The episode became one of the clearest public examples of a car company’s telemetry data reaching an industry, insurance, that drivers rarely think to connect to their daily commute.

8. Ford: Listening For Conversations

A Ford patent application describes a system that would monitor in-car dialogue to detect when occupants are having a conversation, information the filing ties directly to targeted advertising.

A patent filing does not guarantee the feature ever ships, but it shows Ford’s own engineers were actively designing a way to use cabin audio for ad targeting rather than solely for voice commands or safety alerts. Automakers routinely file patents years before, or instead of, building the technology described, but the filing still shows in-cabin listening was seriously considered as an advertising data source rather than ruled out.