Hyundai Motor America is the U.S. sales/marketing arm of South Korea-headquartered Hyundai Motor Company, maker of connected vehicles equipped with the Bluelink telematics/app platform. Hyundai's own U.S. privacy notice and its incorporated Vehicle Technologies and Services Privacy Notice describe broad vehicle telemetry collection (driving speed, acceleration, braking, GPS trip data, ignition/steering events), consent-based collection of sensitive categories including precise geolocation and biometric (fingerprint) data, and self-declared 'sale and/or disclosure for Targeted Advertising' of identifiers, commercial information, and geolocation data to named categories of recipients including Sirius XM, ad/analytics companies, social platforms, and data-enrichment partners. Hyundai's own web properties run Google Analytics, Hotjar, and the Meta Pixel. Its privacy notice names Hyundai Motor Company (South Korea) as parent, giving a traceable single-parent ownership chain, though this review relied on the company's own policy statement rather than an independent registry filing. A 2017 CISA/ICS-CERT advisory, developed with security firm Rapid7, documents two Blue Link mobile-app vulnerabilities (CVE-2017-6052, CVE-2017-6054) that could have let an attacker locate, unlock, and start a vehicle; Hyundai shipped a mandatory app update fixing both within roughly two months of disclosure, with no known in-the-wild exploitation. Widely reported 2024-25 Texas Attorney General scrutiny of automaker driving-data sharing with analytics/insurance firms could not be confirmed via a live primary source in this review (the AG's release page did not render fetchable body text and one Wayback attempt failed) and is therefore not reflected in the claims below.
TRACK RECORD
1 ENFORCEMENT ACTION
A CISA (ICS-CERT) advisory on Hyundai Motor America's Blue Link app, developed with security firm Rapid7, states that successful exploitation of two identified vulnerabilities could have allowed a remote attacker to gain access to insecurely transmitted sensitive information and to locate, unlock, and start an affected vehicle; Hyundai released a mandatory Blue Link update (v3.9.6) fixing both flaws (CVE-2017-6052, CVE-2017-6054) within about two months of disclosure, with no known public exploits reported.
Hyundai's Vehicle Technologies and Services Privacy Notice lists a 'Driving Data' category covering speed, acceleration, braking, direction, trip details (mileage, duration, conditions), ignition and steering events, cruise control, seatbelt status, incident information, and related timestamps as data the company may collect from connected vehicles.
Hyundai's U.S. privacy policy states that Hyundai processes consent-based Sensitive Data including driver's license, precise geolocation, and biometric data, and describes how a customer may withdraw consent to each category, including unenrolling from Bluelink to stop precise-geolocation collection.
Hyundai's Vehicle Technologies and Services Privacy Notice states that Hyundai Motor America may disclose Covered Information with Hyundai Motor Company, described as its parent company headquartered in South Korea, identifying the top of the corporate chain in the company's own words.
The Vehicle Technologies and Services Privacy Notice states Hyundai discloses Covered Information to vendors, service providers, suppliers, contractors, or agents who process the data to provide services or perform functions on Hyundai's behalf, in addition to affiliates, dealers, and business partners described elsewhere in the same notice.
Hyundai's privacy policy self-declares that it may 'Sell and/or disclose for Targeted Advertising' the categories Identifiers, Personal Records, Commercial Information, Internet/Network Usage Data, Geolocation Data, and Inferences, naming recipients including Sirius XM, advertising/digital-analytics companies, social media platforms, data-enrichment partners, joint-marketing partners, and dealers.
A CISA (ICS-CERT) advisory on Hyundai Motor America's Blue Link app, developed with security firm Rapid7, states that successful exploitation of two identified vulnerabilities could have allowed a remote attacker to gain access to insecurely transmitted sensitive information and to locate, unlock, and start an affected vehicle; Hyundai released a mandatory Blue Link update (v3.9.6) fixing both flaws (CVE-2017-6052, CVE-2017-6054) within about two months of disclosure, with no known public exploits reported.
Hyundai's privacy policy discloses it uses third-party analytics and advertising tools — including Google Analytics, Hotjar, and the Meta Pixel — on its online services to analyze how visitors interact with and experience the site.