AEVA calls for tougher connected vehicle data laws

The Australian Electric Vehicle Association has submitted policy recommendations to the Federal Government calling for stricter connected vehicle data privacy laws, arguing the changes are needed to address consumer protection and national security risks.

The recommendations urge legislative action to replace reliance on the Privacy Act 1988 and voluntary standards set by the Federal Chamber of Automotive Industries. According to AEVA, the current framework does not reflect how modern connected vehicles collect, process and transmit data.

The submission comes as internet-enabled features become more common across the car market, including in non-electric vehicles fitted with internal SIM cards or telematics systems. AEVA said the issue affects any modern vehicle able to send data to external locations, not just electric cars.

AEVA told government that local rules should draw on elements of Europe’s General Data Protection Regulation and China’s automobile data security regime. It said Australia should adopt a compliance-based approach that applies across brands regardless of where manufacturers are headquartered.

Policy package

Among the proposed measures is a requirement for sensitive information to be processed within the vehicle wherever possible. AEVA said voice recordings, facial scans, cabin camera material and precise driving routes should remain onboard, while any data leaving the car should be stored in Australia rather than transferred overseas for unrelated use.

A second proposal would require optional data collection to be switched off by default. Under that model, drivers would need to actively choose to share data. They would also have the right to see what is being collected and erase personal information, such as synced phone contacts and location history, before selling a vehicle.

AEVA also argued that drivers should be able to share vehicle data with independent mechanics instead of being limited to manufacturer dealership networks. The issue has become more prominent as software systems and remote diagnostics play a larger role in vehicle servicing.

A third area focuses on cybersecurity rules for manufacturers. AEVA is urging the government to introduce binding requirements aligned with the United Nations UNECE standards R155 and R156, which cover cybersecurity management and software updates.

According to the association, those rules would require carmakers to build stronger digital security into vehicles, separate critical systems such as braking and steering from infotainment systems, and maintain ongoing security updates. Many such measures are currently left to voluntary compliance, it said.

AEVA argued that the stakes will rise as connected vehicles become standard in the Australian market, with 95% of all new vehicles sold in Australia by 2035 expected to be internet-enabled.

That growth is taking place in a market with nearly 70 brands headquartered across 12 overseas jurisdictions. AEVA argued that this breadth makes consistent national rules more important because data handling practices can differ significantly between manufacturers.

Consumer concerns

The association framed its submission as a response to mounting concern about data collection in connected cars. Modern vehicles can gather a wide range of information through navigation systems, in-car cameras, microphones, app connections and remote telematics, raising questions about how that information is stored, who can access it and where it is sent.

AEVA said the government has a responsibility to set clear legal boundaries rather than rely on industry-led codes. It argued that stronger statutory protections would give consumers more certainty without limiting access to a broad range of imported vehicles.

James Pickering, National President, AEVA, said: “2026 has been an unprecedented year for electric vehicle uptake in Australia, but consumers nationwide continue to be let down by insufficient data privacy legislation. Instead of instigating fear and distrust in the connected vehicles we drive, policymakers have the power to make effective changes to protect drivers and consumer choice.”

Pickering also said the debate should not be driven by the country of origin of vehicle brands. The focus, he said, should remain on whether manufacturers meet the same legal standards in Australia.

“From Europe to USA, to China and the rest of Asia, we are lucky to welcome such an incredible range of electric cars to our shores. We are great believers in compliance over country-of-origin and will continue our discussions with government to support consumer choice and protection, while also maintaining national security,” Pickering said.

AEVA is a volunteer-run not-for-profit body that advocates the adoption of electric transport in Australia. It describes itself as the world’s longest continuously running electric mobility organisation.