CONNECTED CARS / PRIVACY REVIEW
The journey leaves
an information trail.
Review connected-vehicle data by feature, account, and actual policy—not by an alarming headline alone.
A connected car can hold a record of journeys, paired devices, and account access long after a driver has handed back the keys. Privacy therefore belongs in a fleet or rental decision, not just in an app’s settings screen.
Mozilla’s 2023 review made that concern tangible. Its findings need to be attributed and read within the review’s scope rather than presented as proof of identical data collection by every car.
THE EXECUTIVE BRIEF
The decisions that matter.
- Mozilla reviewed 25 brands in 2023; its assessment is a dated research finding.
- A policy’s permitted data categories are not evidence that every vehicle collects every category.
- Review the vehicle, associated account, app, and handover process together.
THE ORIGINAL RESEARCH / SEPTEMBER 2023
What Mozilla found—and what its method could establish.
In its 6 September 2023 release, Mozilla said all 25 brands in the review received its privacy warning. Researchers spent 600 hours examining policies, apps, and responses from manufacturers. The review described broad collection permissions, third-party sharing, inferred information, and limited practical choice.
Mozilla also said it could not confirm whether any reviewed brand encrypted all personal information stored on vehicles. That is a transparency and verification gap, not proof that no vehicle used encryption.
The findings do not establish that every brand collected medical, genetic, and sexual-activity data. Those categories appeared in particular policy discussions. A permission in a notice, an inference, a data field in an app, and observed collection are different types of evidence.
The review was not a controlled test of every car model or configuration. Treat it as a reason to ask better questions and examine current terms, not a permanent ranking for all cars sold today.
THE PRIVACY REVIEW
A car is more than its dashboard.
A DRIVER’S DATA NOTEBOOK
Review four places where information can persist.
VEHICLE
What does the car retain?
Check saved destinations, paired devices, user profiles, and any information visible to the next driver.
ACCOUNT
Who can still connect?
Review the vehicle account, authorised users, remote functions, and any access left with a previous keeper.
APP
What is the companion service allowed to do?
Check permissions, optional sharing, and the current terms for the account and region.
HANDOVER
What must be removed or transferred?
Use the manufacturer’s procedure and confirm that the business or rental return process covers digital access.
CyberSolace review prompts. Actual controls and stored information vary by vehicle, service, market, and configuration.
A driver may be able to reduce some optional sharing without controlling every data flow. Do not promise that switching off one phone permission or rejecting marketing means the manufacturer receives no information.
For a business fleet, separate the employer’s purposes from those of the manufacturer, leasing company, insurer, or app provider. Identify who can answer a data question and who can change a setting. Procurement and HR may need to participate alongside IT.
BUYING, RENTING & RETURNING
Make digital handover an ordinary part of vehicle handover.
Before selecting a vehicle or connected service, ask for the relevant privacy notice and a usable explanation of its functions. Identify which features depend on an account, what optional sharing can be declined, and what support exists for a change of driver.
When using a hire car, consider whether pairing a phone or importing contacts is necessary. Follow the rental company’s and manufacturer’s instructions for removing saved information and disconnecting associated accounts before return.
For owned or leased fleets, maintain a documented transfer process when someone changes role or leaves. Include account ownership, authorised users, saved locations, and any remote-access capability. A factory reset should be used according to the actual product instructions; do not assume it terminates every related cloud account.
READ THE SOURCE TODAY
The old guide has moved; the dated findings remain relevant.
Mozilla’s buyer-guide link now points to its archive and product-review notice. The accessible 2023 release is provided here so readers can still trace the findings.
Personal privacy tools on a phone or browser do not necessarily control telematics sent by a car. The more useful starting point is to understand the particular vehicle’s functions, current terms, and account controls. Ask for clarification where a supplier’s answer is unclear.
A PRACTICAL NEXT STEP
Add a digital handover check to the next vehicle return.
For a fleet review, bring procurement, the fleet owner, and the people responsible for employee information into the same discussion.
SOURCES & EDITORIAL REVIEW
Historical findings and incident accounts are dated in the text. Illustrative review prompts are CyberSolace commentary. Editorial review: 20 October 2026.