Leapmotor says Dahua cameras pose no privacy risk as it defends data practices

Leapmotor stands by its camera supplier

Leapmotor will continue to use cameras supplied by Chinese company Dahua despite the supplier's equipment being removed from Australian government buildings, and says most of its customers are not concerned about their data being breached. Leapmotor Australia boss Andy Hoang told Australian media including CarExpert that "the cameras are from Dahua, that's what we've been advised," but stressed "the vehicles themselves have been independently tested for certification for privacy." ¹

Mr Hoang told CarExpert that reviewing the camera functionality showed "nothing in there to suggest anything other than the cameras are designed to help with safety driving functionalities," with footage captured only by the dashcam and exported via USB. The brand's response follows a wide-ranging ABC Four Corners report on customer data security and privacy, which name-checked Leapmotor specifically for its use of Dahua cameras; the program noted Leapmotor did not respond to its questions. ¹³

Dahua cameras were banned from federal government buildings in Australia in 2023, following similar bans in the US and UK over spyware fears. Shadow Minister for Defence James Paterson told Four Corners it was "extraordinary" that vehicles carrying these cameras were allowed to drive around government buildings and installations, and said Dahua had been directly implicated in human rights abuses and mass surveillance of Uyghur people in China. ¹³

'About two customers' raised concerns

According to CarExpert, Leapmotor Australia says only a small number of customers raised concerns after the Four Corners broadcast. "To be totally transparent with you, if we had 100 customers, we probably had about two customers raise that as something that they questioned or wanted to know more about," Mr Hoang said. He added that owner feedback questioned why cameras would be singled out when phones are also made in China and film constantly, and noted "every car's kind of got" a dashcam or camera. ¹

Leapmotor also pointed to its joint venture with Stellantis, which distributes the brand in export markets, as a reason for confidence in its data practices. Mr Hoang told CarExpert the company complies with the European Union's General Data Protection Regulation, "which is a higher standard than here," and that all of its terms and conditions comply with Europe's requirements. ¹

BYD moves to fix Shark 6 vulnerability

The Four Corners report also examined the ability of BYD and Xpeng vehicles to be remotely accessed. Cybersecurity researcher Dan Hreszczuk of Canberra-based Fortify Labs demonstrated remote access to a BYD Shark 6 while it was being driven, eavesdropping on phone calls, tracking its location and turning off its headlights — but only after spending around two weeks with physical access to the plug-in hybrid ute, during which the ABC reported he identified digital access that was not password protected. The investigation found more safety-critical functions, including the brakes and cameras, could not be accessed. ³⁴⁵

BYD investigated the Shark 6 and identified a software vulnerability, which it says it is fixing with an over-the-air software update. However, CarExpert reports the company noted initial access to the vehicle used in the program required physical contact using special tools. BYD Australia director of public relations Paul Ellis told the ABC, in remarks reported by the Australian Automotive Dealer Association, that "you can't just stand on the side of the road and hack into a BYD that drives past," adding that the software used "doesn't work like that" and that BYD had asked the ABC whether a connected device was present during the demonstration. ⁴¹

In a statement reported by 7NEWS citing CarExpert, BYD Australia chief operating officer Stephen Collins said the company was taking "full and immediate action in reviewing alleged claims made in the Four Corners program relating to unauthorised remote access of certain non-critical vehicle control functions," and would respond in detail once its investigation was complete. Mr Collins also said personal in-car data is held on Telstra servers in Australia and governed by Australian law, and that BYD has publicly called for purpose-built connected vehicle legislation applying equally to every brand in the market. ⁴⁵

BYD also told the ABC it has not and will not provide Australians' data to Chinese authorities, and that it had responded to preliminary inquiries from the privacy regulator. The ABC additionally reported that BYD revised its Australian privacy policy within hours of responding to the program's questions: the previous fine print referred to collecting and using information through surveillance activities, while the replacement policy covers only customer data transmitted via the BYD website rather than the vehicles themselves. ³⁴

What Xpeng told the ABC

An Xpeng insider demonstrated to Four Corners that the company can remotely access a vehicle's location, speed, steering wheel angle, seat position, passenger occupancy and whether the vehicle is braking or accelerating, according to CarExpert's report on the program. However, the company confirmed to the ABC it cannot remotely immobilise or disable a customer's vehicle in Australia, and said there is no capability for this to be done from China or by any third party. It also confirmed it has never provided Australian customer data to Chinese authorities. ³

Federal Energy Minister Chris Bowen, an Xpeng G6 owner, told the program that car manufacturers increasingly have access to such information because "every car now is basically connected," whether made in China, Korea or the United States. Separately, Chinese luxury brand Zeekr addressed similar concerns in May, with international vice president Mars Chen telling Australian media including CarExpert that its products had "complied with all the local laws" and that the brand was "more than happy to support" any future changes to Australian data privacy regulations. ²³

Industry pushes for clearer privacy rules

The report has intensified calls for stronger privacy protections. The Australian Automotive Aftermarket Association is calling for connected vehicles to be explicitly addressed in the Federal Government's privacy reforms, with chief executive Stuart Charity saying "buying a car should not mean surrendering your privacy." The AAAA argues the draft privacy legislation lacks a general requirement for affirmative consent before vehicle-generated personal information is collected, and wants manufacturers accountable for software security throughout a vehicle's working life. ⁴

The Australian Automotive Dealer Association has separately called for greater transparency around connected vehicle technology, saying dealers are increasingly asked by customers what data vehicles collect and which functions can be accessed remotely. AADA chief executive James Voortman said in a press release quoted by CarExpert that "Australian car buyers are asking legitimate questions about connected vehicle technologies and deserve clear answers," and called for collaboration between automakers, regulators, security agencies and other stakeholders. ³⁴

The issue extends beyond Chinese brands. The Office of the Australian Information Commissioner confirmed in April that it was investigating Toyota and Hyundai over their management of connected vehicle data, according to the AAAA, while Privacy Commissioner Carly Kind had earlier confirmed open investigations against two entities at a Senate estimates hearing in February 2026. The Australian Government has released draft legislation to update the Privacy Act and is seeking feedback on measures addressing privacy issues arising from connected vehicles, among other things. ³⁴²