The phrasing around "no vehicle data is stored or retained" implies that they're doing vehicle plate->VIN lookups in their database of cars manufactured and per

The phrasing around "no vehicle data is stored or retained" implies that they're doing vehicle plate->VIN lookups in their database of cars manufactured and perhaps warranties issued, which as the manufacturer of said car they might well be correct to say that no PII is required. There's a missing piece of anti-targeting marketing legislation here, that GDPR won't cover under PII, even if it is eventually found that their plate lookup is a PII violation: Can the manufacturer of an object use their privately-held data about the object to target marketing to the bearer/operator/etc. of that object? Probably, yes, at least until a law is passed or a ruling is issued that states otherwise. The best short-term route of attack here would be on the plate->VIN conversion database, assuming that's what they're using anyways. But long-term, they'll figure out how to use a telephoto lens or LIDAR or paint-embedded QR codes to get VIN numbers somehow, so best to tackle the bigger problem too.