Toyota and Hyundai face examination by the Office of the Australian Information Commissioner (OAIC) for possible violations of national privacy rules, particularly around collection, application and consent procedures for customer details.

Choice indicates the two manufacturers are under review by Privacy Commissioner Carly Kind, following her statement to federal parliament this year that the OAIC was looking into a pair of Asian-origin brands.

Toyota remains the top-selling car brand in Australia, a position it has maintained for over twenty years, while Hyundai marks its 40th year in the market this month and ranks fifth in overall sales for 2025.

Toyota offered no comment on the probe, though its current Connected Services Privacy Policy notes an aim to deliver maximum transparency, reassurance and confidentiality around data handling at every stage.

The policy adds that the company seeks to build trust through careful data management while improving offerings and customer experiences.

A Hyundai representative informed Choice that the brand regards privacy and data safeguards as priorities.

The review may last as long as 18 months based on outcomes and will focus on three main aspects.

Initial attention centers on whether the manufacturers gather personal details exceeding what is needed to run vehicles and their linked services.

Next comes scrutiny of whether owner information reaches outside parties such as sales or marketing groups without explicit permission.

Final focus rests on adherence to rules requiring destruction or anonymization of personal data when it is no longer necessary.

The inquiry arises amid rising numbers of vehicles equipped with connectivity features, spanning electric models as well as traditional petrol, diesel and hybrid variants.

Connected cars feature built-in internet access allowing transmission and receipt of information for tasks like real-time traffic routing, remote temperature adjustment, wireless software upgrades and crash response services.

Such systems first entered mass production in 1996 with General Motors OnStar in select Cadillac models, while a basic form reached Australia in 2001 via Holden Assist in luxury sedans.

Toyota introduced its Connected Services locally with the Yaris Cross in 2020, offering emergency support and theft tracking, and Hyundai launched Bluelink services on the 2023 Palisade in August 2022.

A 2024 Choice study of connected-car privacy across ten brands placed Toyota in the middle range, whereas Hyundai ranked among those raising greater concerns.

In late July the Australian Electric Vehicle Association urged stronger federal rules on connected-vehicle data, noting that 1988-era privacy laws fall short for current needs.

The group warned that with 95 percent of new vehicles expected to be internet-enabled by 2035, risks to consumers and security could grow without action.

The government enacted initial privacy reforms in 2024 but has not yet advanced the next stage, which would introduce firmer consent standards, wider definitions of personal data and deletion rights.

A spokesperson for Attorney-General Michelle Rowland stated that Australians expect their information to be handled responsibly and that further measures are being refined for effectiveness.

Recent years have seen several incidents involving connected-car data elsewhere, including GM facing accusations of unauthorized collection and sales, followed by a five-year US ban on certain data sharing.

National security considerations have also prompted restrictions on Chinese vehicle technology in the US and bans on Chinese-made vehicles at military sites in Israel and Poland.