← IoT Privacy Database

Subaru Starlink

Subaru Corporation · Connected Car

Staff Reviewed — a person at DeSpy reviewed this rating.

7.0Surveillance
Index
Policy — what its policy permitsF
Evidence — what research provesF

Collects name, SSN, browsing history, geolocation, audio recordings of occupants and driving telemetry, sold to marketing firms, data brokers, LexisNexis and Liberty Mutual; also faced a BIPA biometric-data lawsuit.

Why this rating

Subaru's Starlink collects name, SSN, browsing history, geolocation and in-cabin audio, sold to marketing firms, data brokers, LexisNexis and Liberty Mutual, and its DriverFocus biometric monitoring drew a separate BIPA class action.

What it is

Manufacturer
Subaru Corporation
Category
Connected Car
Model years
2017-present
Market status
Current
Companion app
MySubaru

The evidence 3

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S4Mozilla: Privacy Nightmare on Wheels — Every Car Brand Reviewed Flunks Privacy Test
    Ngo review · Mozilla Foundation · 2023-09-01

    Mozilla's *Privacy Not Included* review found all 25 major car brands failed its privacy standards, the worst category it had ever reviewed.

    Why it matters here: Mozilla's car privacy review covers Subaru's Starlink connected-services program.

  2. S4Mozilla Privacy Not Included — Subaru Review
    Ngo review · Mozilla Foundation · 2023-09-01

    Mozilla's review of Subaru's Starlink connected-services privacy practices, flagging extensive data collection and sharing with third parties.

    Why it matters here: Dedicated Mozilla Subaru review details extensive third-party data sharing including LexisNexis and Liberty Mutual.

  3. S2Alarmed at Subaru's Data Collection (Reddit thread)
    Journalism · Reddit · 2024-01-01

    Owner-driven discussion thread flagging the scope of Subaru's Starlink data-collection disclosures.

    Why it matters here: Owner discussion thread documents real-world concern over Subaru's data-collection disclosures.

Where your data goes

Third parties this device's data has flowed to, and on what basis. An ended tag means the flow has verifiably stopped — it stays listed for the record.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database