Evaluating privacy permissions and consent requested to use a new motor vehicle

Organization

Automobile Protection Association

Published

2026

Project leader

George Iny

Summary

The Automobile Protection Association (APA) inventoried the privacy permissions and releases automakers require of their Canadian customers in exchange for access to the onboard features and connected applications in their vehicles. Automakers are governed by PIPEDA (or substantially similar provincial legislation, e.g., British Columbia, Quebec, and Alberta) and require customer consent to the collection of their personal data. The APA compiled its information using current-model-year 2025 and 2026 vehicles, owner’s manuals, and automaker websites.

Some key findings included:

• The industry is failing to obtain freely given, informed consent to the use of personal information, and the approach to data collection is wildly inconsistent across brands.
• Information available onboard via the touchscreen interface is laborious to consult (over 100 scrolling screen displays) and often incomplete.
• Information collected can include the customer’s Social Insurance Number, permissions to record in-vehicle conversations, location tracking, websites visited, contacts, and driving habits.
• Information available online is hard to access and sometimes contradicts the in-vehicle permissions.
• Some automakers require full opt-in to information sharing or the customer must opt-out of all connected features.
• Waivers and limitations of liability are excessive. Some automakers offer no warranty on vehicle software, state that they are not responsible for the consequences of their gross negligence or that of third-party vendors, require the customer to give up recourse to the courts in favour of mandatory arbitration, and to not participate in any class action. These are limitations prohibited in some Canadian provinces.

Project deliverables are available in the following language(s):

Pending

OPC funded project

This project received funding support through the Office of the Privacy Commissioner of Canada’s Contributions Program. The opinions expressed in the summary and report(s) are those of the authors and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada. Summaries have been provided by the project authors. Please note that the projects appear in their language of origin.

Contact information

George Iny

Email: george_iny@hotmail.com or apamontreal@apa.ca