"Why is it acceptable on any level for my car to become a spyware device on par with Facebook, when I paid an enormous sum to be its owner and controller for my own benefit, and not to become a residual profit stream for ${CAR_COMPANY}?".

What's a dossier like that with on the market when it includes location, Bluetooth IDs of all occupants and private conversations? $5/mo? $10$?

(not to excuse ISP data collection, but implying that a car is as critical for network access as an ISP is nonsense)

https://en.m.wikipedia.org/wiki/Data_Retention_Directive

Signal for example, is also subject to US law. They can be compelled to reveal everything they have in a person. Which they happily do: they hand over a page with the date of account creation and the day it last connected. Which is all they have.

Don't collect information, and you don't have a problem.

Privacy is not about what someone _might_ do with your data, it’s what they _can_ do with your data.

It’s also that they have your data, which means it can be exposed to staff or the world as the result of a breach.

On the second point, sure, but so we have knowledge of what, how, and for how long, the carmakers are storing?

What they do with the data changes based on leadership (should we sell to 3rd party data brokers to increase our revenue or not?)

It’s also out of their hands once a subpoena for that data comes from law enforcement.

It's important to know what they do with that data today.

It's also important to know what they could do with that data tomorrow.

Even if a company provides assurances and pledges never to mishandle your data or use it for nefarious purposes, there remains a risk that your data could still end up in the wrong hands.