Toyota Australia says highly sensitive connected-car data is encrypted and never leaves the vehicle

Toyota's assurance on in-car data

Toyota Australia has confirmed that highly sensitive customer data is encrypted and never transmitted from its vehicles, following recent calls for greater government regulation of information generated by connected cars, CarExpert reports. Speaking at a business update at Toyota's Port Melbourne headquarters, vice president of sales, marketing and franchise operations John Pappas told the publication the company is extremely diligent in handling data, with customer privacy a priority. ¹

“Our data systems are hosted in secure data centres, the majority of which are located in Australia, with some data also processed and stored in secure Toyota-managed environments in North America and Singapore,” Mr Pappas told CarExpert. Asked whether a Toyota could be hacked, he declined to comment on other brands but said: “Any highly sensitive data is fully encrypted inside the car, is never transmitted.” He likened the company's approach to data protection to its approach to physical vehicle safety, describing it internally as “hardware equals software”. ¹

A million connected Toyotas and what still leaves the car

Toyota told CarExpert there are now more than one million connected Toyotas on Australian roads, after Toyota Connected Services launched in November 2020. Almost every model across the current passenger and commercial range offers the service, with exceptions including the LandCruiser 70 Series, GR86 and Tundra. ¹

Some data does leave the vehicle in defined circumstances. CarExpert notes that SOS Emergency Call, included free by Toyota for the life of the relevant mobile network and part of ANCAP's 2026 assessment protocols, can transmit information required to provide emergency assistance, and Toyota says the service has been used more than 10,000 times in Australia. Stolen Vehicle Tracking data may similarly be provided to police; the publication notes models including the RAV4, HiLux and LandCruiser 300 Series have been among targets during a rise in vehicle thefts, including in Victoria where thefts have reached two-decade highs. ¹

Toyota also updated its Connected Services Privacy Policy in March 2026. CarExpert reports the current policy states that, outside specified circumstances, Toyota does not share information about a customer's use of Connected Services with anyone else unless asked, and that personal information collected through the service is not used for direct marketing. ¹

Regulatory scrutiny without findings

Toyota is currently the subject of an ongoing investigation by the Office of the Australian Information Commissioner, which is also investigating Hyundai over connected-vehicle privacy, CarExpert reports. The regulator has not publicly detailed either investigation or announced any findings of wrongdoing by either brand. It began preliminary inquiries into connected-car privacy in February 2024, but the vehicle brands involved were not made public until 2026. ¹

An industry ahead of Australian law

Earlier reporting by GoAuto in August 2026 found the federal government and intelligence agencies had yet to engage with the automotive industry on connected-vehicle data security, despite ASIO deputy director general Lisa Alonso Love warning politicians at a senate estimates hearing to exercise caution when travelling in vehicles equipped with connected services. Polestar Australia managing director Scott Maynard told GoAuto his company had never been approached by government on cybersecurity, while BYD Australia public relations director Paul Ellis said the industry was applying elements of the Australian Privacy Act from 1988 that “almost certainly did not foresee a scenario with connected vehicles almost 40 years on”. ²

Cybersecurity figures suggested the ASIO warning was grounded in more than theory. Tony Ridley, chief security and risk advisor at EMA Global and author of research on vehicle security vulnerabilities, told GoAuto that “the deputy director general (of ASIO) doesn’t speculate; she speaks to evidence and verifiable facts”, arguing such public warnings are typically issued after an occurrence rather than in speculation about what might happen. ²

In the same GoAuto report, Toyota's John Pappas was quoted describing the company's connected systems as designed with “privacy-first engineering principles”, ensuring only data required for core safety services is activated by default, with sensitive information such as facial biometric markers or in-cabin video encrypted and never transmitted. Other brands set out their own arrangements: Mazda says data from its China-built 6e and CX-6e stays on a Singapore server while other models send data to Japan, and Polestar says no customer data passes through or is held in China. ²

Independent research points to a broader problem

The scale of data sharing in the wider connected-vehicle ecosystem was highlighted by a peer-reviewed study from researchers at Northeastern University conducted in partnership with Consumer Reports, reported by TechCrunch. Researchers tested 21 late-model vehicles from 17 automakers – including GM brands, Ford, Lucid, Rivian, Tesla and Toyota – plus 30 companion mobile apps, and found 19 of the 21 vehicles sent data to at least one third party. Seven of the 30 apps gave sensitive data such as VINs, emails, phone numbers and precise location to companies associated with tracking and advertising. ³

According to TechCrunch's report of the study, data was shared with tech companies including Adobe, Google, Microsoft, Meta, Snap and Yahoo, and pairing a companion app to a vehicle roughly doubled exposure to advertising and tracking companies. The findings were shared with the manufacturers, and the researchers said all but Honda shifted blame elsewhere; Honda instead ordered its vendor Amplitude to delete geolocation data it had received. ³

Closer to home, CarExpert reports that BYD changed its privacy policy after the ABC's Four Corners investigation aired on September 21, 2026, with the program reporting that the revised policy removed previous references to 16 countries to which customer data could be sent. BYD launched an investigation into the program's findings and subsequently said it would implement software changes, “thereby eliminating the access path identified during the investigation”. Canberra-based Fortify Labs, which carried out the vehicle ‘attacks’ for Four Corners, suggested introducing a cyber-security star rating to allow customers to compare the level of protection offered by different brands. ¹