E.g. Tesla, even in Europe, is pretty blatantly ignoring privacy laws and is used to surveil the population: https://www.spiegel.de/panorama/justiz/tesla-waechtermodus-f... (paywall)
I would be very surprised if it didn't have some kind of "heavily-restricted debugging interface, only available to select VW engineers, which provides a limited set of fully anonymous vehicle diagnostic metrics" - which in practice is of course used to sell trivially deanonymizable data to anyone with a few bucks to spare.
https://reynardsec.com/en/volkswagens-bad-streak-we-know-whe...
"The data, which includes detailed location information and even vehicle owner details, was left exposed and unprotected on the internet for an extended period of time."
Wir wissen wo dein Auto steht Volksdaten von Volkswagen
https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...
The US regulators wouldn't have cared about higher emission levels as all cars in the US have them anyway, but the cars were still introduced with the EU specs. First because otherwise they would need to remeasure all the car emissions and second, because even as the real emissions would still be low by US standards that would have questions why the same car has different emissions in EU and US. That plan however didn't work out, as the US doesn't do tests in a controlled environment, but while actually driving. Thus, the scandal started becoming public. That is the official part.
The following comes from an "industrial expert", that held a guest lecture at our university: This whole thing was actually done with knowledge (and silent agreement) of the EU regulators, as they aren't dumb and know what is physically possible. However they were still forced to act once this became public in the US, as the politicians and the general voter don't like regulators doing there own thing against the law. Also this was done by a VW supplier, which is basically the only shop in town, so of course this wasn't specific to VW.
So in my opinion, blaming VW, while legally correct, is actually kind of dumb. At last a bit anecdotal evidence: We also did the update for our car. Of course we tried to delay it, but eventually the car would have lost it's street legality, so we needed to do it. And afterwards the car is louder, has visible emissions and smells (more). (No, this isn't even a car from VW or any other company of the same business group.) Thanks. Sometimes the best option would have been to just keep quite and stick to gentlemen agreements.
Sure, but it is not like they just got away with that (ironically other manufacturers who did essentially the same thing, did mostly get away with it).
>I would be very surprised if it didn't have some kind of "heavily-restricted debugging interface, only available to select VW engineers, which provides a limited set of fully anonymous vehicle diagnostic metrics" - which in practice is of course used to sell trivially deanonymizable data to anyone with a few bucks to spare.
The GDPR allows you to receive a copy of all data a manufacturer has about you, "trivially deanonymizable" is by any reasonable interpretation of the GDPR personal data. Of course you can believe that VW and other manufacturers are secretly ignoring laws (again) and of course evidence for that would be hard to come by, but it it did come out it would be a massive scandal, with a massive criminal investigation.
In general, do you want to have minimal laws protecting your privacy and manufacturers blatantly not caring about existing laws and individuals having no recourse or do you want strict laws protecting your privacy with manufacturers facing heavy sanctions, when they ignore those laws? The choice seems pretty clear.
In 2024 when they got hacked it turned out they were gathering (and "lost") a great deal of user data that they weren't supposed to.
https://cybersecuritynews.com/volkswagen-data-breach/
I don't think that VW were punished for that breach; the GDPR has no teeth.
I drive a VW but I won't buy another.