← IoT Privacy Database

Volvo Cars / Polestar Connected Vehicle

Volvo Cars · Connected Car

Staff Reviewed — a person at DeSpy reviewed this rating.

4.8Surveillance
Index
Policy — what its policy permitsD
Evidence — what research provesD

Volvo and Polestar connected cars run Google built-in and a Volvo/Polestar account that collect precise location, driving and charging behavior, in-car voice, and (in newer models) driver-monitoring camera data, tied to your identity. Both firms' privacy notices acknowledge that sharing personal data with advertising, analytics and social partners may constitute a 'sale' under California law, though they do provide an opt-out. Compared with mass-market peers they are relatively transparent and offer clearer opt-out tooling, but the underlying data collection is still extensive.

Why this rating

Both notices concede sharing for advertising 'may be a sale' under CCPA (sells-data), disclose to analytics/social/advertising partners (broker-disclosure), and collect precise location and voice (sensitive-collection); a functional opt-out avoids the no-opt-out penalty and lifts the score above peers. Evidence: Volvo confirmed a 2021 breach in which R&D data was stolen (major-breach), but that was corporate IP, not customer telematics; there is otherwise little independent study of Volvo/Polestar consumer-data practices, so the consumer-privacy record is largely unstudied.

What it is

Manufacturer
Volvo Cars
Category
Connected Car
Model years
2021-present
Market status
Current
Companion app
Volvo Cars app / Polestar app

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S3It's Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy
    Ngo review · Mozilla Foundation · 2023-09

    Mozilla flunked all 25 car brands reviewed, including Volkswagen and Audi, for over-collection and selling/sharing personal data.

    Why it matters here: Category-level context for Volvo/Polestar's connected platform; not a brand-specific finding.

  2. S3Volvo Cars discloses security breach leading to R&D data theft
    Breach report · BleepingComputer · 2021-12

    The Snatch extortion group stole a limited amount of Volvo Cars R&D property from a file repository, which Volvo confirmed after samples were leaked.

    Why it matters here: Shows a data-protection failure at the manufacturer, though the stolen material was R&D IP rather than customer telematics data.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database