Is your car spying on you? The car brands that collect and share your data revealed in new investigation from Choice with Hyundai, Kia, Tesla, Ford and Toyota at the top of the list

An investigation by Australian consumer advocacy group, Choice, has revealed several of Australia’s leading car brands are harvesting driver’s data, and in some cases, offloading it to third-party providers.

The investigation analysed each of the top 10 selling company's respective data collection policies and responses to detailed questions.

Choice found three car brands – Kia, Hyundai and Tesla – were collecting and sharing the most intimate data with third parties, based on available information.

Hyundai and Kia, which share the same parent company, captured voice recognition data from drivers that it then shared with third-party provider Cerence, a US-based software company with an interest in artificial intelligence-powered interactions across transport.

Tesla, on the other hand, was found to be gathering voice command clips as well as short video clips and images that are likely used to inform its automated driving technologies.

Car brands deemed as less intrusive, either because they don't collect biometric data or their response to questioning was simply unclear, were also found to be collecting and sharing driver’s data.

Toyota and Ford were deemed less intrusive as their approach to data collection and sharing was linked to informing their driving systems rather than voice or facial recognition data.

MG was found to be collecting data, but it was unclear from the company's response as to whether it was being shared. Mazda also admitted to collecting and sharing “voice consumption” data with undisclosed third parties, a phrase it did not clarify to Choice.

Mitsubishi, Isuzu Ute and Subaru were the three companies found not to be collecting any data whatsoever.

CarsGuide is not suggesting this behaviour is illegal, but the investigation does raise questions about the ethics of long, convoluted terms and conditions agreements that make it difficult for the consumer to fully understand what they are signing before they opt in.

Dr Vanessa Teague from the Australian National University's College of Engineering, Computing and Cybernetics told Choice the behaviour was unacceptable.

"Opt-out is not the answer; you should have to opt-in to some of these features if you want them. Many of these other features should simply be illegal," she said.

CarsGuide contacted several car brands, including Hyundai, Toyota, Kia and MG, in response to the investigation to ask about the purpose of data collection and whether or not consumers should be concerned with each company's approach to data collection.

In an email, a spokesperson for Hyundai provided a fully-detailed document for Hyundai’s BlueLink service, a program where drivers can opt-in in two parts, “in-vehicle” and through Hyundai’s smartphone app.

Once opted in, the "in-vehicle" program will collect location data through the activation of automatic collision notifications, by which the car will immediately contact Hyundai's call centre in the case of a collision. Opting in will also provide drivers with the use of voice recognition technology to allow for spoken commands, data that Hyundai then collects.

The document wasn’t entirely clear on what – if any – further data the app collected, although it gives consumer’s full-time personalised access to vehicle status functions such as fuel, battery or tyre pressure levels, as well as vehicle location and trip pre-planning.

The document reveals customers can opt out of the service at any time by either deactivating or deleting their BlueLink account, with the second option deleting all historical data.

Toyota also responded to CarsGuide’s request for comment, echoing comments to Choice that some vehicles are fitted with a Data Collection Module (DCM), which Toyota said enhances the safety, security, driving and convenience features of the vehicle.

The data is used to inform Toyota’s SOS Emergency Assist Program, Automatic Collision Notification, Drive Pulse (which monitors car performance functions on each trip), Remote Connect (which provides remote locking and unlocking) and Stolen Vehicle Tracking programs.

Owners can opt out at any time through Toyota’s myConnect app, though customers trying to remove the DCM entirely may find it affects the functionality of other features such as the microphone and speakers. It may also void a customer's warranty, should the repairs be carried out by an unauthorised Toyota repairer.

Kia and MG did not respond before the deadline. An update will follow with each company’s response.