← IoT Privacy Database

Rivian Connected Vehicle

Rivian Automotive · Connected Car

Staff Reviewed — a person at DeSpy reviewed this rating.

3.9Surveillance
Index
Policy — what its policy permitsC
Evidence — what research provesC

Rivian's R1T and R1S continuously collect precise location, driving and charging data, in-car voice, and driver-monitoring camera data linked to a Rivian account. Rivian states it does not 'sell' personal data but does share limited data with third-party advertisers under California's definition, and it offers an unusual privacy control: owners can disable connectivity (a toggle in Canada, or eSIM deactivation elsewhere) to stop data leaving the vehicle, at the cost of navigation, OTA updates and some driver aids. No independent research has audited what Rivian actually does with the data.

Why this rating

Policy shares limited data with advertisers under CCPA's 'sharing' definition (sells-data) and collects precise location, camera and voice (sensitive-collection), with some vague service-provider language (policy-vagueness); but a genuine connectivity kill switch (local-processing-mode) and an explicit no-sale commitment (data-minimization-commitment) lift the policy score well above peers. Evidence: unstudied - there are no confirmed breaches, regulatory actions or independent measurements of Rivian's data flows, so the evidence score is capped; the only independent note is favorable coverage of its connectivity kill switch.

What it is

Manufacturer
Rivian Automotive
Category
Connected Car
Model years
2022-present
Market status
Current
Companion app
Rivian app

The evidence 1

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S1Rivian's Internet Kill Switch: First EV Privacy Control
    Journalism · byteiota · 2026-05

    Coverage of Rivian giving owners a toggle to fully disable vehicle connectivity so data stops leaving the car, described as a rare pro-privacy control among EVs.

    Why it matters here: The only independent commentary specific to Rivian's data practices, and it is a favorable design note; actual data-flow behavior remains unaudited.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database