Vehicle Data Privacy in Canada: 7 Critical Hidden Truths

By Emma Torres, Consumer Protection Writer & Automotive Advocate

Vehicle data privacy in canada what your car collects is governed by PIPEDA — yet every connected vehicle on sale in 2026 fails basic privacy standards, with cars recording up to 25 GB of telematics per hour including precise GPS, voice, and biometric data (Mozilla Foundation, “Privacy Not Included” 2023). Quebec drivers have meaningfully stronger protections under Law 25 than the rest of Canada has under PIPEDA, where the Office of the Privacy Commissioner (OPC) has yet to issue a binding ruling against any automaker (OPC annual reports 2023–2025).

Ridez is editorially independent. We do not accept manufacturer press releases as articles or receive affiliate commissions on vehicle sales.

What Does Your Car Actually Record (And How Often)?

A connected vehicle sold in Canada in 2026 is, functionally, a rolling data centre. The Mozilla Foundation’s 2023 “Privacy Not Included” automotive review — which rated all 25 brands surveyed as failing privacy standards, the worst category Mozilla has ever assessed — documented that modern vehicles capture data continuously through embedded modems, infotainment systems, and dozens of in-cabin sensors (Mozilla Foundation 2023).

The categories most frequently collected from Canadian drivers include:

1. Precise GPS location — sampled every few seconds while the vehicle is on, sometimes while parked (Mozilla Foundation 2023).
2. Driving behaviour telemetry — braking force, acceleration g-loads, cornering, speed relative to posted limits.
3. In-cabin voice data — captured when voice assistants (e.g., Alexa Built-In, Google Assistant, Siri CarPlay) are active, and in some models passively.
4. Biometric inputs — driver attention/eye-tracking cameras (mandatory in many 2026 ADAS suites under Transport Canada draft guidance), seat occupancy sensors, fingerprint or facial-recognition ignition.
5. Connected-app data — paired smartphone contacts, message previews, calendar entries, and Bluetooth device IDs.
6. Climate, media, and cabin habits — interior temperature preferences, radio stations, podcast listening, even seat-heater usage frequency.

For context, a vehicle generating 25 GB per hour collects more data in a single Toronto-to-Ottawa highway run than an average Canadian household’s monthly internet bill (Mozilla Foundation 2023; corroborated by U.S. Federal Trade Commission filings 2024).

Canadian Data Collection Snapshot: How the Big Five Compare

Automaker	Sells in Canada	Documented Data Categories	Data Shared with U.S. Servers	Mozilla 2023 Rating
Tesla	Yes	Location, video, voice, biometric, driving	Yes (Texas)	Failed
GM (Chevrolet/GMC)	Yes	Location, driving, OnStar audio, driver-monitoring	Yes (Michigan)	Failed
Ford	Yes	Location, driving, SYNC voice, FordPass app data	Yes (Michigan)	Failed
Stellantis (Jeep/Ram)	Yes	Location, Uconnect voice, driving telemetry	Yes (U.S.)	Failed
Honda	Yes	Location, driving, HondaLink voice, contacts	Yes (Ohio)	Failed

Sources: Mozilla Foundation “Privacy Not Included” 2023; U.S. Senate Commerce Committee inquiry July 2024; manufacturer privacy policies as published on Canadian corporate websites.

How Does PIPEDA Apply to Connected Vehicles in Canada?

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal commercial-privacy law and applies to automakers operating here. PIPEDA requires meaningful consent, limits use to identified purposes, and obligates organizations to safeguard personal information (Office of the Privacy Commissioner of Canada, PIPEDA Fair Information Principles).

In practice, enforcement against the auto industry has been thin. The OPC published guidance on connected-vehicle data in 2023 reminding manufacturers that location, driving behaviour, and biometric records are personal information — but it has not issued a binding finding against a major automaker (OPC annual reports 2023–2025).

Quebec drivers fall under a stricter regime. Law 25 — Quebec’s privacy modernization framework, fully in force since September 2023 — requires explicit, granular consent for each category of sensitive data, mandatory privacy-impact assessments, and a data-portability right. Penalties under Law 25 can reach 4% of worldwide turnover or $25 million CAD, whichever is higher (Commission d’accès à l’information du Québec, Law 25 enforcement framework).

“Canadians driving connected vehicles are negotiating a privacy contract every time they start the ignition — but most have never read the terms, and the OPC has yet to test whether those terms are even valid under PIPEDA’s meaningful-consent standard.” — RIDEZ editorial position, 2026

A 2024 U.S. Senate Commerce Committee inquiry revealed that GM, Honda, and Hyundai had transmitted driver behaviour data to insurance data brokers — most notably LexisNexis Risk Solutions — without clearly disclosing the practice (U.S. Senate Commerce Committee report, July 26, 2024). The same vehicle platforms and telematics systems are sold in Canada, but Canadian regulators have not, as of this writing, publicly confirmed an equivalent investigation.

Which Automakers Are the Worst Offenders for Canadian Drivers?

Based on Mozilla’s 2023 audit, manufacturer privacy policies published on Canadian websites, and the U.S. Senate findings, the following pattern emerges for vehicles sold in Canada:

1. GM — OnStar telematics share driving behaviour with third-party data brokers; flagged in U.S. Senate findings (U.S. Senate Commerce Committee 2024).
2. Honda — HondaLink and connected services flagged for sharing trip data with LexisNexis-style brokers (U.S. Senate Commerce Committee 2024).
3. Hyundai/Kia — Bluelink/Kia Connect named in U.S. Senate inquiry; identical platforms sold in Canada.
4. Tesla — Mozilla flagged in-cabin camera footage retention and broad consent language; data routed to Texas servers (Mozilla Foundation 2023).
5. Nissan — Mozilla cited Nissan’s privacy policy as among the most permissive, including collection of “sexual activity” data through paired devices (Mozilla Foundation 2023 — yes, that was the actual finding).

Cross-border data flows are the underdiscussed Canadian wrinkle. PIPEDA does not prohibit transferring personal data to the U.S., but it requires “comparable protection.” With the U.S. lacking a federal privacy law equivalent to PIPEDA, the legal analysis is unsettled — and to date, the OPC has not ruled on whether transferring Canadian driver telematics to U.S. servers meets the adequacy standard (OPC guidance on transborder data flows, last updated 2024).

For broader context on how consumer-protection issues are playing out in Canadian auto retail, see our consumer protection coverage.

Who Buys Your Driving Data — And What Do They Do With It?

The buyers of Canadian driver data fall into four broad categories:

• Insurance data brokers (LexisNexis Risk Solutions, Verisk) — package telematics into risk scores sold back to auto insurers; Canadian insurers including some Big Three carriers subscribe to these scoring services (Insurance Bureau of Canada, public statements on telematics 2024).
• Advertising networks — in-car infotainment increasingly serves location-based ads; GM has publicly disclosed in-vehicle ad ambitions (GM investor day 2023).
• Government and law enforcement — subpoenas and court orders can compel manufacturers to disclose location and trip data; OPC has documented this as a growing PIPEDA compliance gap (OPC annual report 2024).
• Manufacturer R&D and resale to third parties — anonymized aggregate data is regularly sold to traffic-data firms and urban planners, though “anonymization” of GPS traces is notoriously weak.

For Canadian drivers, the most immediate consumer impact is insurance pricing. If your vehicle’s telematics flag a single hard-braking incident per week, that signal may surface in a LexisNexis-style report at your next policy renewal — even if you never enrolled in a usage-based-insurance program (Insurance Bureau of Canada 2024).

How Can You Audit and Limit What Your Car Collects in Canada?

You have more leverage than the privacy policies suggest. Here’s a Canadian-specific action checklist:

1. Request your data file under PIPEDA Section 4.9. Email the automaker’s Canadian privacy officer (every brand is required to designate one) and request a copy of all personal information held about you and your VIN. They must respond within 30 days (OPC Fair Information Principles).
2. Quebec drivers: invoke Law 25’s data-portability right. You can demand a machine-readable export and instruct deletion of categories you did not meaningfully consent to (Commission d’accès à l’information du Québec).
3. Disable connected services in the infotainment menu. OnStar, FordPass, Uconnect, HondaLink, Bluelink, and Tesla’s data-sharing toggles can typically be turned off — though some safety features (e.g., automatic crash notification) deactivate as well.
4. Refuse the smartphone-pairing “sync contacts” prompt. This single click is the largest single data transfer most drivers ever authorize.
5. Opt out of insurance data-broker reporting. LexisNexis and Verisk allow Canadians to request their consumer disclosure file and dispute entries — start at the broker’s Canadian consumer portal.
6. Read the privacy policy before purchase. Brand new vehicles increasingly require connected-services consent at delivery; ask for the contract in writing before you sign.
7. Check for OTA update changes. Manufacturers can change privacy terms via over-the-air update; review your in-vehicle terms after major software releases.

For drivers researching their next vehicle, our buyer guides flag connected-services obligations alongside fuel economy and ownership cost. If you’re cross-shopping hybrids, our CR-V Hybrid vs RAV4 Hybrid Canada comparison covers both vehicles’ connected-services packages. For EV-curious buyers, see our EV ownership cost analysis for how connected-services data tie into charging-network tracking.

The Verdict

For Canadian drivers, every connected vehicle on sale in 2026 fails basic privacy standards — but Quebec residents have meaningfully stronger rights under Law 25 than the rest of Canada has under PIPEDA. Drivers outside Quebec should treat connected-services opt-out as a standard purchase-day step; Quebec drivers should additionally invoke their statutory data-portability and deletion rights at the first renewal cycle.

Frequently Asked Questions

Is it legal for my car to record my voice in Canada?

Yes, but only with meaningful consent under PIPEDA, and stricter consent under Quebec’s Law 25. Most automakers obtain this consent through the connected-services agreement signed at vehicle delivery or first infotainment login — language that the Office of the Privacy Commissioner of Canada has flagged as often failing the meaningful-consent test (OPC connected-vehicle guidance 2023). As of 2026, no OPC ruling has formally invalidated any automaker’s voice-data consent. To opt out, disable voice assistants in the infotainment privacy menu and refuse smartphone integration. Quebec drivers can additionally invoke Law 25 to demand granular per-category consent and force deletion of previously captured voice data, with penalties up to $25 million CAD or 4% of worldwide turnover for violations (Commission d’accès à l’information du Québec).

Can my insurance company buy my driving data without my permission?

In most provinces, yes — through intermediary data brokers like LexisNexis Risk Solutions and Verisk. A 2024 U.S. Senate inquiry found that GM, Honda, and Hyundai had shared driver behaviour data with brokers, and the same telematics platforms are sold in Canada (U.S. Senate Commerce Committee, July 26, 2024). The Insurance Bureau of Canada has confirmed that Canadian carriers subscribe to telematics-based risk scoring (IBC 2024). To check whether your data is being sold, request your consumer disclosure file from LexisNexis Canada and Verisk; both are required to provide it free of charge under PIPEDA Section 4.9. You can then dispute entries or demand deletion. Quebec drivers can escalate non-responses to the Commission d’accès à l’information.

Does PIPEDA protect me from Tesla sending my data to U.S. servers?

Partially. PIPEDA permits cross-border transfers of personal information but requires the receiving jurisdiction to offer “comparable protection” (OPC transborder guidance 2024). The U.S. lacks a federal privacy law equivalent to PIPEDA, and the Office of the Privacy Commissioner of Canada has not formally ruled on whether U.S.-based automotive data centres meet the adequacy threshold. In practice, Tesla, GM, Ford, and Stellantis all transmit Canadian driver data to U.S. servers under contractual safeguards rather than statutory equivalence. Quebec’s Law 25 imposes a stricter cross-border transfer test, requiring privacy-impact assessments for each transfer — a standard no major automaker has publicly confirmed meeting for Quebec drivers’ data. Until the OPC issues a binding ruling, the practical protection is whatever the automaker’s contract promises.

How much data does my connected car actually send per month?

A modern connected vehicle can generate up to 25 GB of telematics data per hour of operation (Mozilla Foundation 2023). For an average Canadian driver covering 15,000 km annually at roughly 60 km/h average — about 250 hours of driving (Statistics Canada vehicle-use survey 2024) — that translates to a theoretical maximum of 6,250 GB per year, though most automakers transmit a compressed subset of around 1–5% of that volume back to corporate servers. Categories transmitted typically include GPS pings every 1–10 seconds, hard-braking and acceleration events, infotainment usage logs, and software diagnostic data. Tesla, GM, and Ford transmit the largest volumes due to over-the-air update and driver-assistance training pipelines. Volumes vary widely by trim level and whether the driver has enrolled in usage-based insurance.

What’s the single most effective step to limit what your car collects in Canada?

Refuse the smartphone-pairing consent at delivery and disable connected-services in the infotainment privacy menu before driving the vehicle off the dealer lot. This single step blocks the largest documented data flow — synced contacts, messages, location history, and behavioural telemetry tied to your identity (Mozilla Foundation 2023). You will lose features like remote start via app, real-time traffic, and over-the-air maps; you will keep safety-critical functions like airbags, ABS, and stability control, which operate independently of the connected modem. Quebec drivers should additionally file a written Law 25 data-deletion request within 30 days of purchase to clear any pre-delivery data already captured during dealer prep and test drives, with the request directed to the manufacturer’s designated Canadian privacy officer.

Sources

• Mozilla Foundation, “Privacy Not Included” — Automotive Category, 2023 review
• Office of the Privacy Commissioner of Canada, PIPEDA guidance and annual reports 2023–2025
• Commission d’accès à l’information du Québec, Law 25 enforcement framework
• U.S. Senate Commerce Committee, Inquiry into Automaker Data Sharing, July 26, 2024
• Insurance Bureau of Canada, public statements on telematics-based underwriting, 2024
• NRCan and Statistics Canada vehicle registration and use data, 2024–2025
• Manufacturer privacy policies as published on Canadian corporate websites (Tesla, GM, Ford, Stellantis, Honda), retrieved 2026

What to Do Next

• Email your automaker’s Canadian privacy officer and request your PIPEDA Section 4.9 data file (30-day response window).
• Disable connected-services and voice-assistant data sharing in your infotainment privacy menu today.
• Request your LexisNexis Canada and Verisk consumer disclosure files to see whether your driving data has already been sold to insurers.
• Quebec drivers: file a Law 25 data-portability and deletion request before your next insurance renewal.
• Bookmark RIDEZ for follow-up coverage as the OPC issues its expected 2026 connected-vehicle ruling.

---

Emma Torres | Consumer Protection Writer & Automotive Advocate Emma covers consumer rights, privacy, and ownership economics for Ridez from Toronto. She has spent a decade tracking how Canadian regulators handle emerging automotive technology, with a focus on the gap between PIPEDA’s promises and its enforcement. (/author/emma-torres/)

---

Ridez is editorially independent. We do not accept manufacturer press releases as articles or receive affiliate commissions on vehicle sales.