Volkswagen AG is a Frankfurt-listed automaker whose US privacy statement (Volkswagen Group of America) discloses that its connected vehicles (via the myVW+ service and myVW mobile app) collect Vehicle, Diagnostic, Infotainment, GPS-location and driving-behavior data, and states that some driving/behavioral data may be used for or shared for targeted advertising in ways that constitute a 'sale' or 'sharing' under state privacy law, alongside disclosed sharing with Volkswagen Group affiliates, dealers, and opted-in insurance partners. Ownership is fully traceable: Volkswagen AG's own investor-relations page discloses voting-rights control split between Porsche Automobil Holding SE (53.3%), the State of Lower Saxony (20.0%), Qatar Holding (17.0%) and free float, and the Cariad connected-car software unit is confirmed as a VW subsidiary. Two verified track-record incidents were found via primary sources: a June 2021 breach notification filed by Volkswagen Group of America with the California Attorney General (Audi/VW customer contact-information letter templates on file), and a December 2024 Chaos Computer Club disclosure that Cariad-collected movement/geolocation data for hundreds of thousands of VW, Audi, Skoda and Seat vehicles — including police, intelligence and military-linked vehicles — was stored long-term and left unprotected on the internet.
TRACK RECORD
1 ENFORCEMENT ACTION
[2021-06-10]
California's Attorney General data-breach registry lists a June 10, 2021 data breach notification filed by Volkswagen Group of America, Inc., with sample notice-letter attachments addressed to Audi customers regarding contact information, consistent with the disclosed 2021 vendor breach affecting Audi/VW customer records.
Volkswagen Group of America's privacy statement discloses that the company collects information directly from the vehicle itself, including data about the vehicle's performance, status, and GPS location, as part of its broader connected-vehicle (myVW+) data collection.
The Chaos Computer Club's own disclosure article identifies Cariad, the software unit behind Volkswagen's connected-vehicle location data collection, as a Volkswagen subsidiary ('VW-Tochter Cariad'), confirming the ownership chain from the connected-car business unit to the parent group.
Volkswagen AG's own investor-relations page discloses the company's current voting-rights distribution: Porsche Automobil Holding SE holds 53.3%, the State of Lower Saxony holds 20.0%, Qatar Holding (spelled 'Quatar' on the page) holds 17.0%, and 9.7% is free float, as of December 31, 2025.
VW's privacy statement discloses routine sharing of customer information with the broader Volkswagen Group corporate family — parents, affiliates, subsidiaries, and business units, explicitly including Volkswagen AG itself — in addition to sharing with dealers and service providers described elsewhere in the same statement.
California's Attorney General data-breach registry lists a June 10, 2021 data breach notification filed by Volkswagen Group of America, Inc., with sample notice-letter attachments addressed to Audi customers regarding contact information, consistent with the disclosed 2021 vendor breach affecting Audi/VW customer records.
The Chaos Computer Club disclosed at the 38th Chaos Communication Congress (December 2024) that the Volkswagen Group systematically collected and stored, over long periods, movement/geolocation data for hundreds of thousands of VW, Audi, Skoda and Seat vehicles, and that this data — including information about vehicle owners and vehicles tied to police, intelligence, and military sites — was left unprotected and accessible on the internet.
The myVW app's Apple App Store privacy-nutrition label self-declares a 'Data Linked to You' category (including Purchase History, Contact Info, and Device ID Identifiers) that may be used for the developer's own advertising or marketing purposes, in addition to a separate 'Data Not Linked to You' category for analytics and diagnostics.