Avis is the flagship car-rental brand of Avis Budget Group, Inc. (NASDAQ: CAR), which also operates Budget and Zipcar. Avis's own privacy notice discloses broad collection including "Connected Car Data" from telematics-equipped rental vehicles (which can include in-vehicle camera images and audio recordings) and biometric facial-comparison data used for its QuickPass/Avis First contactless identity-verification services, plus routine ad-tech tracking via cookies, pixel tags and mobile SDKs shared with third-party advertising partners using a common hashed identifier for cross-device matching. The policy states plainly that personal information has been sold or may be sold in the future to third parties. In August 2024 the company suffered a confirmed data breach — attackers accessed a business application between August 3-6, 2024 and exfiltrated personal information including names, addresses, driver's license numbers and financial account details for roughly 299,006 customers, per Avis's notification to the Maine Attorney General reported by SecurityWeek.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
5 ON FILE
[2025-12-18] · COLLECTION
Avis's North America privacy notice discloses that some rental vehicles are "connected cars" equipped with telematics systems and on-board devices that collect "Connected Car Data" / "Vehicle Data" including location, mileage, speed and diagnostic data, and states that certain connected vehicles may also be equipped to capture camera images, both inside and outside the vehicle, as well as audio recordings.
Avis Budget Group, Inc.'s FY2025 Form 10-K (SEC EDGAR, CIK 0000723612) states the company is a leading global provider of mobility solutions through its three most recognized brands, Avis, Budget and Zipcar, and confirms its common stock trades on the Nasdaq Global Select Market under the ticker symbol CAR.
Avis's privacy notice self-declares a sale of personal information under CCPA/CPRA-style categories, stating information may be sold to third-party ad networks, social networks and advertising partners unless the consumer has opted out.
In September 2024, Avis notified the Maine Attorney General's Office that approximately 299,006 customers were affected by an August 2024 data breach; the company's investigation found attackers had access to its network between August 3 and August 6, 2024 and exfiltrated personal information, including names, addresses, dates of birth, driver's license numbers and financial account data.
The privacy notice states Avis uses cookies, pixel tags, beacons, scripts and mobile SDKs to profile visitors and their preferences, and separately discloses that Avis may share a common account identifier such as a hashed email address or user ID with third-party advertising partners to identify users across devices for targeted advertising.