On 6 November 2026 Canada's Office of the Privacy Commissioner (OPC) published the completed 2025-2026 Contributions Program projects on smart devices. Two of them concern connected vehicles, and together they point at an uncomfortable conclusion. The consent model for new cars is broken, and no single technology or new statute will repair it alone.
What the research found
The Automobile Protection Association (APA) inventoried the privacy permissions and releases that automakers require of Canadian buyers of 2025 and 2026 model-year vehicles. Its project, "Evaluating privacy permissions and consent requested to use a new motor vehicle," concludes that the industry is "failing to obtain freely given, informed consent" to the use of personal information.
The details are specific:
- The touchscreen disclosures are "laborious to consult," running to over 100 scrolling screen displays.
- Data collected can include location tracking, in-vehicle recording permissions, websites visited, contacts, driving habits and, in some cases, the customer's Social Insurance Number.
- Some automakers require full opt-in to information sharing, or the customer must opt out of all connected features.
- Some require customers to give up recourse to the courts in favour of mandatory arbitration and to not participate in any class action. The APA notes these are limitations prohibited in some Canadian provinces.
The work was modest in scale. The OPC's grant record shows a contribution of $43,005 to the APA between July 2025 and March 2026, and the APA describes it as, to its knowledge, the first inventory of its kind in Canada.
The second project: technology is necessary but not sufficient
The University of Windsor team led by Dr. Mitra Mirhassani looked at the supply side. Its project, "Driving privacy forward: Homomorphic encryption and oblivious AI in smart mobility," built and tested an approach that lets mobility data stay protected while it is analyzed. Its headline finding is that "technology alone is not enough." The team also calls for clear responsibilities, understandable consent, transparent communication, common technical standards and early privacy planning. Stakeholders raised cost, system performance, integration and the need for evidence that protections actually work.
The two projects fit together. Encryption protects data in use, but it says nothing about whether a buyer who tapped "accept" on the fortieth screen understood what they agreed to.
The strongest case for tougher rules
The case for intervention is serious. A car purchase is among the largest transactions most households make, and the vehicle is hard to return once the dealer has the signature. A buyer who declines the data terms may lose features they paid for. Consent obtained under those conditions is closer to a condition of sale than a choice. The Privacy Commissioner told a House of Commons committee in April 2026 that modern vehicles collect large volumes of personal data, including location history and driving behaviour, and that the OPC had funded these two projects with results expected within months. Advocates reasonably conclude that voluntary good practice has failed and that prescriptive rules are overdue.
Why prescriptive mandates are the wrong response
The failure the APA documents is mostly a failure to apply existing principles. Canada's federal private-sector law, PIPEDA, already requires meaningful consent and transparency. The OPC has not been short of legal theory. The practices described, such as consent buried across 100 screens and all-or-nothing bundling, are hard to defend under existing principles. What has been missing is a targeted investigation and a public finding against a named automaker.
That points to a proportionate agenda:
- Enforce first. The OPC should use the APA inventory to select practices for formal investigation, especially bundled consent and Social Insurance Number collection. Collecting a number that is not needed for a vehicle sale is hard to square with data-minimization expectations, and a public finding would change industry behaviour faster than a new bill.
- Regulate the outcome, not the tool. The Windsor findings caution against writing a particular privacy-enhancing technology into law. Homomorphic encryption carries real cost and performance trade-offs, and a mandate would freeze a fast-moving field. Standards bodies and procurement requirements can reward good designs while leaving room for better ones.
- Separate consent layers. Core vehicle operation should never depend on agreeing to data sharing for marketing or resale. Optional connected features should be individually switchable. This is a design requirement that automakers can meet without new technology.
- Strike unfair waivers through the courts and provincial law. The APA says class-action and court-access waivers are prohibited in some provinces. Provincial consumer regulators, rather than privacy law, are the natural tool here.
A note on the wider data debate
Canadians are also debating state access to private data. The Electronic Frontier Foundation argues that Bill C-22, the Lawful Access Act, would let the Minister of Public Safety order a backdoor provided it does not create a "systemic vulnerability," and would require services to retain metadata for up to a year. The EFF post does not discuss vehicles, so any application to automaker telematics would be our inference, not a finding. The relevant point is that the more personal data automakers collect by default, the more there is to be compelled, breached or resold. Data minimization at the point of collection is the common protection against all three.
The bottom line
The OPC's research programme has done what research should: it documented a problem with evidence. Canadian drivers should not need to read more than 100 screens to learn who receives their location and conversations. The sensible next steps are an investigation, a clear opt-in standard for non-essential data uses, and technical standards that encourage privacy-preserving analytics without mandating one method. New legislation can wait until enforcement of the existing law has been tried.