Most car brands are stumbling on consumer privacy protections, study finds

A recent study has suggested that most auto brands are struggling to protect the privacy of consumers, at least when compared to California regulations.

Zooming in: The study, conducted by Privacy4Cars, specifically analyzed how car brands support Californian consumers in exercising privacy rights for interactions and web browser flows—finding that most fall short on best practice concerns raised by the California Privacy Protection Agency (CCPA) in its March 2025 settlement with American Honda Motor Company.

The median UX privacy rating across 44 brands included in the study was only 1.7 out of 5.0.
Only Acura and Honda earned a score in the 90-100% range—after making changes post CCPA enforcement, with a score of 4.6 out of 5.0.
Subaru scored a 3.8 UX privacy rating among all car brands surveyed, followed by Polestar and Rivian with a score of 3.3 out of 5.0.

❝

What they’re saying: “Privacy4Cars' goal in publishing this benchmark report is to create a common rating system and shared goals, so privacy can be put on a trajectory of continuous improvement, investment, and opportunity—as it happened when safety ratings were made visible to consumers a generation ago," said Andrea Amico, Founder and CEO of Privacy4Cars. "This is why we ‘crash tested’ the UX and processes of privacy portals, cookie management tools, links, and more—using the now established precedent of Honda's settlement as the yardstick.”

Worth noting: Privacy4Cars’ evaluation was based on 12 criteria and best practices derived from real-world examples, including technical (e.g., clicks, form fields, button size) and pragmatic (based on what other brands have implemented)—with most auto brands scoring below 3.0.

Why it matters: Prior to CPPA action, Honda scored just 0.8—proving that enforcing privacy best practices for UX adoption can drive brands to make improvements, as noted by Privacy4Cars. Six manufacturers, covering 12 brands, engaged proactively pre-publication of the study, with some making changes significant enough to warrant re-scoring.

The elephant in the room: Privacy4Cars is a private tech company focused on solving privacy and data security issues in automotive, and could benefit commercially from these results.

❝

“We still have major questions about Privacy4Cars’ methodology and business practices,” a spokesperson for the Alliance for Automotive Innovation told The Record. “The criteria this group used to grade automakers doesn’t reflect the industry’s privacy policies or compliance with California’s privacy law… Automakers are committed to protecting consumer privacy and vehicle data. Full stop.”

Zooming out: While the Privacy4Cars study is focused specifically on California, digital marketing, sales, and service applications in automotive are also on the rise. 47% of U.S. consumers shopping for new policies now purchase them through websites or mobile apps.

Bottom line: UX and consumer data privacy are emerging as core components of the shifting automotive landscape. Just as safety evolved from a compliance issue into a competitive advantage, brands that lead on privacy-centric practices will win consumer trust, loyalty, and market share, while laggers risk regulatory pressure and reputational harm.

A quick word from our partner

Are your dealership's marketing efforts stuck in neutral?

It's time to stop wasting ad spend on the wrong people and drive sales with precision. That’s where Experian Automotive comes in.

Our Marketing Audiences give you the power to target customers who are ready to buy right now.

We have the high-quality, accurate data you need to identify the hottest prospects, including:

Vehicle owners nearing the end of their leases or loans, or those with positive equity.
Shoppers with a proven preference for specific makes, models, or vehicle segments.

We also have over 750 ready-to-use syndicated audiences, to help you find and engage your ideal buyers.