Five years before Australian regulators opened a file on Toyota and Hyundai, General Motors stood in front of a room of investors and put a number on exactly what a modern car’s data is worth. Not a guess. A target, published in a press release and repeated in filings with U.S. securities regulators: $20 billion to $25 billion a year, by 2030, in software and services revenue from roughly 30 million connected vehicles. A single line item inside that number, OnStar Insurance, was projected to bring in more than $6 billion annually on its own. Nobody forced GM to disclose this. The company volunteered it, because at the time, it sounded like good news.
That detail is missing from almost every headline about Australia’s new privacy investigation into Toyota and Hyundai.
The instinct is to treat the Office of the Australian Information Commissioner’s probe as a story about two companies caught doing something shady. It isn’t, not really. It’s a story about an entire industry that already told its own shareholders, in writing and years in advance, how much a car’s data pipeline is worth. Regulators are only now getting around to asking who agreed to let them build it.
What Regulators Are Actually Asking
The OAIC’s investigation, first disclosed by Privacy Commissioner Carly Kind during Senate estimates and later confirmed by name after questioning from Nationals Senator Bridget McKenzie, centers on three questions, according to reporting from Australian consumer group CHOICE: whether Toyota and Hyundai are collecting more personal data than their connected services actually require, whether that data is shared with third parties such as marketing partners without owners’ knowledge, and whether either company properly deletes or de-identifies information once it’s no longer needed. The OAIC expects the process to take up to 18 months. Toyota has pointed reporters to its connected-services privacy policy. Hyundai has said only that it takes privacy seriously. Neither has denied anything specific, because there’s nothing yet to deny. The findings aren’t public.
The Auto Wire has already covered how a nearly identical case played out in the United States, when GM’s OnStar Smart Driver program fed geolocation and driving-behavior data to consumer reporting agencies that insurers used to help price coverage. Toyota and Hyundai are now facing their own version of that same question. What hasn’t been reported yet is what the rest of the industry already put in writing about where all of this was always headed.
The Business Plan, In Writing
Go back to that 2021 GM investor day. Buried in the same materials that spelled out the $20 to $25 billion software target is a line most owners will never read: in its own SEC-reviewed risk disclosures, GM lists tightening data-privacy regulation as an official threat to that growth plan. In other words, the profit projection and the privacy fight live in the same document. GM didn’t stumble into this. It priced in the possibility that regulators would eventually show up.
Toyota and Hyundai aren’t outliers for building a similar connected platform. They’re simply the two that got named first. CHOICE’s own 2024 review of ten car brands’ data practices found Hyundai sharing drivers’ voice-biometric data, the digital signature of an owner’s actual voice, with a third-party artificial intelligence company. That distinction matters more than it sounds. A location ping expires the moment a trip ends. A voiceprint doesn’t. Banks, phone carriers, and government services increasingly use voice biometrics to verify identity, so once that data leaves the car and lands with an outside vendor, the owner has no way of knowing how long it’s stored, who else can see it, or what it eventually gets used to unlock.
A Patent Nobody Asked For
Here’s a detail that never made it into the Australian coverage at all. In February 2023, Ford Global Technologies filed a patent application, later published by the U.S. Patent and Trademark Office as US20240289844A1, describing a system that selects in-car advertisements based on a vehicle’s location, speed, drive mode, predicted destination, and audio captured from inside the cabin. The filing is marked abandoned in the public record now, which in patent terms usually means Ford stopped paying to prosecute it, not that the idea died. Companies file defensive patents on concepts they never ship all the time. What the filing proves is simpler: someone in Ford’s legal department decided a system built on cabin audio and driving behavior was worth protecting as intellectual property. A real engineering team spent real hours writing a real specification for a feature no customer ever requested.
Why There’s No Off Switch
Here’s the part that should bother owners more than anything above. Turning this technology off isn’t a hard engineering problem. A vehicle’s telematics control unit is, at its core, a cellular modem wired into the car’s network. Disabling its transmission is roughly as complicated as pulling a SIM card. Vanessa Teague, a cybersecurity researcher who has reviewed connected-car systems, told CHOICE that manufacturers could build a simple, physical kill switch into every dashboard tomorrow. By her account, they don’t, and the reason isn’t technical difficulty. An easy off switch is bad for a revenue line that’s already been promised to shareholders.
The Pattern Is The Story
None of this is unique to Toyota and Hyundai, and that’s the uncomfortable part. Every connected car sold today, regardless of badge, runs on the same trade: the owner gets live traffic, remote start, and stolen-vehicle recovery, and the manufacturer gets a rolling record of that owner’s behavior with real resale value to somebody else. The Auto Wire has tracked that same instinct show up in unrelated corners of the business, from Ford’s separate attempt to patent a system for remotely repossessing a financed vehicle, to the private-equity-driven push to turn car washes into recurring subscriptions instead of one-time purchases. The common thread isn’t any single bad feature. It’s an industry-wide shift toward recurring revenue extracted from an asset customers already paid for once.
Toyota and Hyundai will spend up to the next 18 months answering the OAIC’s questions. Whatever the agency concludes, it won’t change the sentence already sitting in GM’s own securities filings: growth from connected vehicles was always going to depend on collecting exactly the kind of data regulators are now asking permission for. A recall means a car failed to do what it was built to do. This isn’t a recall. It’s a car doing precisely what it was engineered to do, quietly, on behalf of someone who isn’t the person holding the keys.