Subaru of America, Inc. (a U.S. distribution subsidiary of Tokyo-listed Subaru Corporation) sells connected vehicles equipped with the STARLINK telematics platform and the EyeSight external-camera driver-assist system. Subaru's own Vehicle Privacy Notice discloses that precise geolocation is collected across many connected-service features (remote commands, boundary/speed alerts, ignition on/off events, diagnostic alerts), is retained for one year and then pseudonymized and kept for an additional six years, and states Subaru does not sell this geolocation data to third parties, while separately disclosing broad sharing of other personal information with service providers, affiliates, promotion/marketing partners (e.g., SiriusXM, Liberty Mutual), and law enforcement. In November 2024, independent security researcher Sam Curry disclosed (published January 2025) an admin-portal account-takeover vulnerability in Subaru's STARLINK system that would have let an attacker retrieve any vehicle's full year of location history and control remote functions using only a license plate or similar identifier; Subaru patched the flaw within 24 hours of disclosure and the researcher states it was never exploited maliciously. Ownership is traceable via Subaru Corporation's Tokyo Stock Exchange listing and public shareholder disclosures, which show Toyota Motor Corporation as the largest single shareholder.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
6 ON FILE
COLLECTION
Subaru's Vehicle Privacy Notice states that Subaru collects precise geolocation data whenever a MySubaru user initiates the 'locate vehicle' remote command, and separately discloses that Subaru collects vehicle data at every ignition-off and ignition-on event -- including precise geolocation, vehicle diagnostics (odometer, tire pressure, fuel, battery data), and vehicle status (seatbelt, door, windows) -- alongside similar geolocation collection tied to boundary/speed/curfew alerts, SOS assistance, stolen-vehicle recovery, and diagnostic alerts.
Subaru Corporation's own investor-relations stock-information page states the company's stock (code 7270) is listed on the Tokyo Stock Exchange Prime Market and lists Toyota Motor Corporation as its largest shareholder, holding 21.46% of total shares as of March 31, 2026.
Subaru's Vehicle Privacy Notice states directly that Subaru of America does not sell customers' precise vehicle-geolocation data to third parties, while the same notice discloses that geolocation and other MySubaru data are shared with service providers, SOA affiliates, and (with a warrant except in imminent-risk situations) law enforcement.
Subaru's Consumer Privacy Policy discloses that when a customer buys or leases a vehicle, Subaru shares the customer's identifiers with SiriusXM (to provide a free satellite-radio trial) and with Liberty Mutual (to market Subaru Advantage Insurance), and separately states that sharing with ad-measurement and promotion partners may be deemed a sale or disclosure for targeted advertising under state privacy law, requiring a consumer opt-out.
Security researcher Sam Curry's own published writeup states that on November 20, 2024 he and a collaborator discovered a vulnerability in Subaru's STARLINK admin portal that gave 'unrestricted targeted access to all vehicles and customer accounts in the United States, Canada, and Japan,' allowing retrieval of a full year of precise vehicle location history and remote control of vehicle functions using only identifiers like a license plate; the same writeup states that after Subaru was notified, the affected system was patched within 24 hours and was never exploited maliciously.
Subaru's Vehicle Privacy Notice describes the EyeSight driver-assist system as an externally-facing camera that records images outside the vehicle when automatic emergency braking or sudden braking is triggered; the images are stored locally in the vehicle and Subaru states it only accesses them with the owner's separate signed consent or a valid court order.