Car executives asking to be regulated is not a common sound in nature. It sits somewhere between “please audit me” and “raise my taxes.” So when the head of Lexus Australia says the country needs a national framework governing what cars collect about their occupants, it’s worth asking what he thinks is coming, and why he’d rather meet it on his own terms.
Jack Hobbs made the comment to the NRMA’s Open Road, published 21 August. Asked whether Australia needs a consistent policy on vehicle data, he answered “It’s a little bit like safety. The broad answer is yes,” and added that the topic deserves the same weight as a driver’s physical wellbeing, with more education and transparency from the industry. He also said Lexus would comply with whatever Canberra writes, and that Europe is a sensible template — which is how Australia has historically handled emissions and crash standards anyway. NRMA
That last part is the tell. Toyota and Lexus already build to UNECE cybersecurity rules for Europe, and R155 and R156 require a certified cybersecurity management system and a software update management system as a condition of type approval. A manufacturer already paying that compliance bill has every commercial reason to want the same rules applied to everyone else selling in the market. Regulation you’ve already absorbed is a moat.
What the cars are actually doing
Lexus told Open Road that connected services ship switched off, with the exception of emergency functions — SOS and automatic collision notification — and that everything else requires an opt-in through the app, with layered consent per feature. The company says it doesn’t collect data with the intent to sell it, that customers can call in to opt out and request deletion, and that it keeps data onshore where possible, though some connected-services applications route to North America or Japan.
Related Articles
- BMW’s Driveshaft Problem Is Back — And Some Owners Could Lose Their Rear Wheels
- Kia Telluride Battery Drain Lawsuit: What the Federal Complaint Actually Says
Worth understanding what “off” means mechanically. The hardware doing this work is the telematics control unit, an embedded cellular modem with its own SIM, GNSS receiver, and a direct tap into the vehicle’s CAN bus. It doesn’t power down because you declined a subscription; it stays registered to a mobile network so the crash-notification path works. What toggles is which data streams get published upstream. Anyone who has looked at a Lexus dealer’s disclosure will see the shape of what’s available on that bus — vehicle location, speed, odometer readings and diagnostic data all sit in the same collection bucket as your finance details. Consent is a software gate on a hardware capability that never leaves.
The report behind the timing
Hobbs wasn’t speaking into a vacuum. The NRMA published a policy paper the same day, built with cybersecurity firm Irdeto, data lawyer Peter Leonard’s Data Synergies, e-mobility advisory enX, and the National Institute of Strategic Resilience. It’s 29 pages and unusually specific for a motoring-club document.
The legal gaps it identifies are the interesting part. Australian surveillance device statutes generally don’t bite on cars, because vehicles aren’t classified as surveillance devices — and privacy notices typically bind only the owner or primary driver, not passengers, and certainly not the pedestrian your exterior cameras just recorded. The Cyber Security Act 2024 set minimum security standards for smart devices and then carved road vehicles and vehicle components straight out. EV charging networks aren’t designated critical infrastructure under the SOCI Act, while the EU treats charge point operators as essential or important entities under NIS2.
What’s filling that space is the FCAI’s voluntary code, in force since July 2021, which commits signatories to principles rather than obligations and carries no penalty for ignoring it.
The report also notes the regulator has moved past commentary. Formal OAIC investigations into vehicle suppliers are underway, examining whether manufacturers are collecting more personal information than necessary and sharing it without informed, voluntary consent — the paper’s own pull quote is blunt: “Manufacturers are collecting more personal data than necessary.” Location tracking in cars sits explicitly on the Privacy Commissioner’s list of regulatory priorities.
NRMA members, for their part, aren’t ambivalent. Seventy per cent said they were unwilling or unlikely to buy from a brand that trades in their information, with 36 per cent ruling that brand out entirely. Ninety-five per cent flagged remote hacking or unconsented data sale as a top concern. Twenty-six per cent admitted they didn’t read the terms when they bought the car.
Americans have already seen the bill
If this reads as a distant problem, it isn’t. In January the FTC finalised a 20-year order against General Motors and OnStar over precise geolocation and driving behaviour data — a five-year ban on disclosing that data to consumer reporting agencies, affirmative express consent required before collection or sharing, plus mandated access and deletion rights for US consumers, with the Commission describing “GM’s egregious betrayal of consumers’ trust.” The original complaint alleged hard-braking events and late-night trips were logged and sold onward into a pipeline that feeds insurance pricing. Federal Trade CommissionFederal Trade Commission
That’s the insurance mechanism laid bare. Telematics data doesn’t need to be labelled a policy discount to affect your premium. Once driving-behaviour records reach a consumer reporting agency, they become an underwriting input like a claims history, and you may never see the file that repriced you. Separately, senators Wyden and Markey asked the FTC to examine whether eight automakers had misled customers about requiring a warrant before handing location data to government agencies.
Related Articles
- A Stolen Porsche Put a Melbourne Flower Farmer in the Hospital. The Anti-Theft Tech Worked Perfectly
- A Stolen 1971 Chevelle Came Home After 33 Years. Now Its Owner Has to Prove It Exists
Washington’s other intervention was national-security flavoured rather than consumer-facing. The Commerce Department’s Bureau of Industry and Security final rule took effect 17 March 2025, prohibiting vehicle connectivity system hardware and software with a Chinese or Russian nexus. Software prohibitions bite from model year 2027; hardware from model year 2030, or 1 January 2029 for units without a model year. Note what that rule protects: the supply chain, not the driver. Your data can still be monetised domestically at full speed. Bureau of Industry and Security
The repair angle nobody’s arguing about yet
Here’s the piece enthusiasts should watch. Australia’s service and repair information sharing scheme lives in Part IVE of the Competition and Consumer Act. As faults migrate from mechanical to software, independent shops need diagnostic and software-related repair access to fix anything. Write privacy rules carelessly — lock vehicle data behind manufacturer consent gates in the name of protecting consumers — and you have accidentally built the tightest dealer-service moat in history, wearing a consumer-protection badge. The NRMA report flags exactly this, calling for owner-authorised access so roadside assistance and independent repair don’t get strangled by well-meaning drafting.
Practical takeaways
Open the connected-services consent screen in your vehicle’s app and read the per-feature toggles rather than the master switch; layered consent means you can usually keep remote start and kill behaviour analytics. If you’re selling a car, deregister it from your account before handover — Lexus’s own disclosure warns that failing to notify a transfer means data keeps flowing to the previous subscriber’s contact details. If you’re buying used, assume the previous owner didn’t, and factor a full account reset into the handover. And for anyone shopping a new car: the handover conversation about data is now as legitimate a question for the salesperson as tyre size. Hobbs is right that dealers should be explaining it. Whether they can is another matter.