More of these cars are entering Australia — and they've sparked a burning question

Experts are warning that popular vehicles pose a major security concern.

ASIO has warned politicians and public servants not to discuss confidential information in internet-connected cars. Source: AAP / Joel Carrett

In brief

• Security experts are warning that internet-linked vehicles are posing increasing risks.
• Ninety-five per cent of vehicles in Australia are expected to be internet-linked by 2035.

Security experts have cautioned that internet-linked vehicles pose an increasing threat to Australian consumers as their data-gathering capabilities grow.

The country's top spy agency, the Australian Security Intelligence Organisation (ASIO), issued a recent warning that government officials should avoid having confidential conversations in internet-linked vehicles.

"Obviously, a connected car may have other vectors to gather that information, but those conversations should only ever happen in places that are set up for classified conversations," ASIO's deputy director general Lisa Alonso Love told Senate Estimates last week.

"We would say that people should be conscious of the things that they are discussing in vehicles, knowing that people may be able to get that information."

Experts have told SBS News that the risk of malicious actors taking advantage of the smart capabilities of vehicles is growing and that the public is unaware of the risks their high-tech cars pose.

"Most people haven't fully ingested how many data points are being collected in a vehicle," Montii Abid, a cybersecurity consultant and researcher at the University of Technology Sydney, said.

"The tech has moved away from being something simple to being a computer with a microphone, cameras, personal data, everything."

A 2021 report by consulting firm McKinsey estimated that half of the vehicles on Australian roads that year were connected to the internet. By 2035, that number is expected to rise to 95 per cent.

The same report found that sensors across the car can generate one to two terabytes of raw data every day.

Legal protections lacking

Australian legal protections are not current enough to deal with the new generation of smart vehicles, Abid said. He has called for a "consent overhaul" in how we approach our transportation, given that internet-linked cars are only expected to expand their data-collection reach.

"If you're a passenger in one of these cars — for example, you're in an Uber— you don't have any protection," Abid said, noting that cameras and microphones can capture personal data about anyone who enters a vehicle.

"[Car] manufacturing is happening overseas, so the data is stored overseas where Australian privacy laws don't apply."

Unlike the European Union's newer flagship privacy framework, the General Data Protection Regulation (GDPR) of 2018, Australia's privacy laws are underpinned by the Privacy Act of 1988.

Abid argued that the rules in Australia are "much weaker" as "there's no opt-out requirement".

"You've got to accept all the data collections to use the vehicle," he said.

Jarni Blakkarly, a journalist with the consumer rights group CHOICE was part of an investigation in 2024 into how much data vehicles in Australia collect on their drivers.

He told SBS that most Australians are unaware of what kind of data their cars are collecting on them and might not be happy with all of it.

"If it just recognises your voice when it says 'take me home' .. that might be one thing," he said.

"But, if your driver data, for example, with your speeding — potentially, we don't know that this is happening in Australia, but potentially — could be shared with your insurance provider, which then goes into your insurance pricing."

Most manufacturers engaging in' concerning' practices

The rise of Chinese-made vehicles in Australia has prompted some concern over the threat of state-backed espionage, but Blakkarly says his research revealed that most companies engage in concerning practices.

"Whether those concerns are also shared for Chinese companies or not, our research didn't look at that, but we found a wide range of companies from a wide range of countries that had concerning practices," he said.

The CHOICE study found that almost all major vehicle brands in the country collect driver data, with most sharing it with third parties.

KIA, Hyundai, and Tesla all shared their users' biometric data with third parties, and Tesla even went as far as recording short video and audio clips that were also shared.

"Where's that data going after these companies get it, and what's it being utilised for?" Blakkarly asked.

"At the moment, there's not a lot of protection in this space, and there have been concerns raised by various regulators about them as well."

Australia's privacy watchdog, the Office of the Australian Information Commissioner (OAIC), confirmed in February that it was investigating two Asian vehicle manufacturers for potential data-harvesting issues.

Two other probes into the excessive data gathering and improper data handling of two further manufacturers were dropped due to the low likelihood of enforcement action.

If consumers are concerned about the information being gathered on them, Abid said they should go online and investigate exactly what data their vehicle manufacturer collects.

"Within the vehicles themselves, you'll find that a lot of them have settings and controls that they can opt in and opt out of."

---

For the latest from SBS News, download our app and subscribe to our newsletter.