It was totally predictable, unfortunately.
At least in the EU it’s quite illegal and even if a car maker slips something in, GDPR is always there so one can request a copy and have it deleted. Wish the regulation was even stricter though.
There is:
a) Zero trust in the car manufacturers to really respect GDPR
b) Zero repercussions for actually stealing my PII. Okay, maybe VW will pay a minuscule fine, but they won't
The GDPR is a joke. It does not prevent the real problem (data collection). Tech companies can in principle be fined for misusing your data, but most companies won't get caught or will simply pay the fine.
How does this work with Europeans who are not based in GDPR regions? As far as I know, they still count, are these systems collecting data about them illegally?
At the same time, EU mandates that new cars must have a system able to call help if it detects a crash with the driver not responding... And I suspect most manufacturers will argue that telemetry data are not PIIs until taken to court, so since they have to put a cellular connection anyway, why not use it?