Toyota Australia says the most sensitive information collected by its connected cars stays inside the vehicle, locked down by encryption. According to the brand, that data is never transmitted. The comments come as connected-car privacy gets a harder look in Australia. A recent ABC Four Corners investigation raised concerns about data security and the potential for connected vehicles to be hacked, and there have been recent calls for greater government regulation of the information these cars generate.
Read more: Toyota RAV4 five-star ANCAP rating could unlock more fleet sales
What Toyota has actually said
Toyota Australia vice president of sales, marketing and franchise operations John Pappas said customer privacy is a priority and that the data is “highly governed”. Asked whether a Toyota could be hacked, he pointed to encryption. “Any highly sensitive data is fully encrypted inside the car, is never transmitted,” Pappas said. He wouldn’t comment on how other brands handle hacking protections.
Toyota says its data systems are hosted in secure data centres, most of them in Australia. Some data is also processed and stored in Toyota-managed environments in North America and Singapore.
It’s worth being clear about what hasn’t been said. Toyota hasn’t spelled out what it classes as “highly sensitive”, and its claim hasn’t been independently verified. That makes it a company position rather than a tested fact.
Why connected cars are under the microscope
A connected car is simply one linked to the internet. That allows over-the-air software updates, but it also gives manufacturers access to things like vehicle location and driving behaviour. Toyota launched Toyota Connected Services in Australia in November 2020. The company said at a recent business update at its Port Melbourne headquarters that there are now more than one million connected Toyotas here. Almost every model in the current passenger and commercial range offers it, with the LandCruiser 70 Series, GR86 and Tundra among the exceptions.
Toyota isn’t just watching from the sidelines. As of October 2026, it is the subject of an ongoing investigation by the Office of the Australian Information Commissioner (OAIC), which is also looking at Hyundai over connected-vehicle privacy. The OAIC hasn’t publicly detailed its inquiry or announced any findings of wrongdoing against either brand. It began preliminary inquiries in February 2024, but the brands involved weren’t made public until 2026.
The Four Corners episode, which aired on September 21, 2026, featured BYD, Xpeng and Leapmotor vehicles. BYD changed its privacy policy, and the program reported the revised version removed earlier references to 16 countries where customer data could be sent. BYD said it would make software changes “eliminating the access path identified during the investigation”.
What gets shared, and when
Toyota updated its Connected Services Privacy Policy in March 2026. Under the current policy, outside specified circumstances, Toyota doesn’t share information about how you use Connected Services with anyone else unless you ask it to. It also says personal information collected through the service isn’t used for direct marketing.
Those specified circumstances matter. SOS Emergency Call can transmit the information needed to get help to you. Toyota includes it free for the life of the relevant mobile network, and it forms part of ANCAP’s 2026 assessment protocols. Toyota says it has been used more than 10,000 times in Australia.
Stolen Vehicle Tracking data may also be provided to police. That’s relevant for local owners, with the RAV4, HiLux and LandCruiser 300 Series among the models targeted during a rise in thefts, including in Victoria, where thefts have reached two-decade highs.
What does it mean for Australian buyers?
If you’re shopping for a connected car, whether a Toyota or anything else, the practical takeaway is to read the privacy policy before you sign. Check what is collected, where it is stored and when it can be shared.
Fortify Labs, the Canberra-based firm that carried out the vehicle “attacks” for Four Corners, has suggested a cyber-security star rating so buyers could compare brands, much like a safety rating. No such scheme has been announced. Whether regulators or the industry adopt the idea is speculation for now. For now, Toyota’s message is clear, but the OAIC’s work is still unfinished. Until it reports, owners are largely relying on what the brands tell them.
Comments
New Comment