VW got caught because of their shit security but what is the situation with all other car makers? The US does not have a GDPR so the collection of this informa

VW got caught because of their shit security but what is the situation with all other car makers? The US does not have a GDPR so the collection of this information is legal. How much data is lying around at GM and others for someone to abuse?