BYD publicly told Australian customers they don't collect driving data, but their own privacy policy says they collect your speed, braking, acceleration, where you go, and how far you drive. The company is directly contradicting its own written privacy statement. BYD promises 'privacy first,' but as a Chinese company they are legally required by China's intelligence law to hand over data if the Chinese government asks. Multiple governments including Australia, the UK, and the US treat Chinese connected vehicles as security threats. BYD cannot guarantee 'privacy first' while being legally compelled to cooperate with Chinese intelligence.
What they claim: BYD states data is stored 'in Australia' on AWS infrastructure and claims not to transfer customer data to Chinese headquarters.
What we found: Firmware hardcoded endpoints include 'global-api.bydauto.com.cn' — a Chinese domain. CVE-2025-28169 documents unencrypted broadcasts from DiLink to cloud servers, meaning data in transit could be intercepted. The DiLink 3.0F FCC filing (SD4-DILINK6125F) was tested by GRG Metrology & Test Group Co., Ltd. in Shenzhen, China. OTA update capability means BYD can remotely change what data is collected and where it's sent without owner notification.
What they claim: The BYD AUTO app requests RECORD_AUDIO (microphone access) and CAMERA permissions for a vehicle companion app.
What we found: In October 2024, an Australian BYD owner discovered the car's internal Telstra SIM could be dialled from an external phone, enabling audio eavesdropping from inside the vehicle with no on-screen indication. The owner could not hang up the covert call from inside the car. Combined with the app's RECORD_AUDIO permission and CVE-2024-46442 (authentication bypass on DiLink headunit), there are multiple vectors for audio surveillance of vehicle occupants.
What they claim: BYD states 'We do not share your any personal data to the below third parties' and claims minimal data collection.
What we found: The BYD AUTO app (com.byd.bydautolink v3.2.4) requests 44 permissions including: CAMERA, RECORD_AUDIO (microphone), READ_CALENDAR/WRITE_CALENDAR, READ_PHONE_STATE, ACCESS_FINE_LOCATION, and advertising permissions (ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_CUSTOM_AUDIENCE, AD_ID). The presence of four separate advertising/attribution permissions indicates data sharing with ad networks despite the 'no sharing' claim.
What they claim: BYD's Vehicle Privacy Statement mentions collecting 'camera' and 'microphone' data for 'normal use of corresponding functions' without specifying what those functions are.
What we found: The BYD AUTO app requests READ_CALENDAR and WRITE_CALENDAR permissions — the ability to read and modify your phone's calendar. No BYD privacy policy or vehicle documentation explains why a car app needs to read your calendar, your phone identity (READ_PHONE_STATE), or write to your calendar. These permissions provide a pattern-of-life profile: where you drive (GPS), when you drive (trip data), and what you have planned (calendar).
What they claim: BYD's Australian Vehicle Privacy Statement states data is processed and stored in Australia using AWS infrastructure.
What we found: BYD has partnered with DeepSeek to integrate its AI into vehicles, raising additional data security concerns. BYD's FCC filing was tested in Shenzhen, China. The Australian Privacy Watchdog is actively investigating car brands over data-harvesting. China holds 78% of Australia's battery EV market, creating systemic surveillance risk. BYD's privacy promise of Australian data storage is technically possible via AWS Sydney/Melbourne, but China's National Intelligence Law could compel BYD engineers with AWS access to exfiltrate data regardless of storage location.
What they claim: BYD's EU page states 'At BYD, we take a Privacy First approach' and the Vehicle Privacy Statement says 'We do not sell your personal data to anyone for any purpose, period.'
What we found: China's National Intelligence Law (2017) Article 7 requires all Chinese organisations to 'support, assist and cooperate with the state intelligence work.' BYD Auto Industry Company Limited is headquartered in Shenzhen, China. ASPI analysis confirms Chinese EVs are 'a rolling security threat.' The Australian Protective Security Policy Framework bans public servants from syncing phones to BYD vehicles. The UK MOD placed warning stickers on vehicles with Chinese components: 'Avoid conversations above OFFICIAL within vehicle.'
What they claim: BYD's Vehicle Privacy Statement says 'We do not sell your personal data to anyone for any purpose, period.'
What we found: The BYD AUTO app includes UWB_RANGING (ultra-wideband ranging) and HIGH_SAMPLING_RATE_SENSORS permissions, enabling precise physical tracking and high-frequency sensor data collection beyond what any privacy policy discloses. UWB can track users to centimetre accuracy. HIGH_SAMPLING_RATE_SENSORS enables collecting accelerometer, gyroscope, and other motion data at maximum frequency — useful for detailed behavioural profiling but undisclosed in privacy documentation.
What they claim: BYD's EU page claims 'BYD manages all third-party software that processes your data' and emphasises data minimization.
What we found: CVE-2024-54728 reveals incorrect access control allowing unauthorised access to system logcat logs containing sensitive data. CVE-2025-7020 (confirmed affecting BYD ATTO 3) shows that BYD's own patch to fix CVE-2024-54728 introduced a new vulnerability — incorrectly encrypted log dumps exposing PII and location data. This demonstrates inadequate software security management where fixes create new vulnerabilities, contradicting the 'managed' claim.
What they claim: BYD DiLink 3.0 runs Android 10 with LTE/4G, WiFi, Bluetooth, and GPS — an always-connected vehicle computing platform.
What we found: CVE-2024-46442 allows authentication bypass via brute-force on the DiLink headunit. CVE-2025-28169 (CVSS 8.1) reveals unencrypted vehicle-to-cloud communications enabling MITM attacks. The Israeli Defence Forces halted BYD vehicle supply over cybersecurity concerns. The US House Committee on Homeland Security raised national security risks of BYD vehicles. Despite 4 CVEs in DiLink, the Atto 3 remains unpatched for CVE-2025-7020 as of the advisory date.
What they claim: BYD spokesperson told Australian media 'data is not collected from Australian BYD owners on how they drive or use their vehicle.'
What we found: BYD's own Vehicle Privacy Statement (byd.com/au/privacy-statement-of-byd-vehicle) explicitly states: 'We collect driving data about your vehicle such as speed, acceleration, and braking data; direction of travel; trip data (mileage, date, location).' Also collects GPS location, seatbelt status, steering data, and cabin environmental data.