Reuters investigation (April 2023) documented that Tesla employees between 2019-2022 privately shared 'highly invasive videos and images recorded by customer car cameras' via internal messaging systems. Despite Tesla's claim that data is not linked to identity, employees retained the ability to look up GPS location of each recording, effectively enabling re-identification. Shared footage included a naked man, crash footage, children, and private garage/driveway scenes. Employees created memes from customer footage viewed by scores of staff. A class-action lawsuit was filed.

Reuters (Apr 2023): Tesla employees shared cabin camera footage — garages, naked bodies, crashes — on internal Slack. Employees looked up owners by VIN. Footage included children and intimate moments. Two former employees confirmed to Reuters. Tesla's privacy claims directly contradicted by documented internal behavior.

The BYD AUTO companion app requests RECORD_AUDIO permission, enabling microphone access. The vehicle privacy statement also discloses voice service providers Cerence and iFlytek process voice data. iFlytek is a Chinese AI company specialising in speech recognition. The combination of RECORD_AUDIO permission in the app and third-party voice processing contradicts the claim of not capturing voice records.

An Australian BYD owner discovered the car's internal SIM card could be dialled by an external party, transmitting audio from inside the vehicle without any indication on the dashboard. The owner could not hang up the covert call from inside the car — not from the phone app, not from the steering wheel button. The eavesdropping persisted even when the car's cellular setting was turned off. BYD later confirmed it was "working on a fix."

In July 2022, the Lower Saxony Data Protection Authority fined Volkswagen AG EUR 1.1 million for GDPR violations related to vehicle testing. VW used test cars with cameras recording traffic without proper data subject notifications — signs with camera symbols and legally required information were missing. VW accepted the fine. This demonstrates that VW Group's data protection compliance is not as rigorous as claimed, even in controlled test scenarios, let alone across millions of connected consumer vehicles.

Rivian vehicles have interior cabin cameras that monitor driver attention for safety features. Like Tesla, the existence of a camera pointed at the driver and passengers raises questions about footage access and retention. Rivian has not published a transparency report detailing law enforcement data requests. In 2023, Mozilla's Privacy Not Included report gave Rivian its worst privacy rating, noting the company "can collect very intimate data — from your sexual activity to your genetic information" per the privacy policy, and that data can be shared with "basically anyone." Mozilla gave every car brand it reviewed a failing grade, but Rivian's adventurous branding masks the same surveillance architecture as every other connected vehicle.