What Data Does a Robotaxi Collect? Your Privacy Rights in Australia
Every time a self-driving vehicle carries a passenger, it generates an extraordinary volume of data. Cameras record the exterior environment at up to 360 degrees. Lidar sensors map everything within hundreds of metres. GPS logs every metre of the route. And the passenger app records exactly who you are, where you went and when. As the robotaxi industry moves closer to Australian roads, understanding what data these vehicles collect — and what rights Australian passengers will have — is more important than most people realise.
What a Robotaxi Actually Collects
The data footprint of a single robotaxi ride is substantial. Autonomous vehicles are effectively rolling data centres, and the information they gather falls into several distinct categories.
Environmental sensor data is the most voluminous. Cameras mounted on the vehicle’s exterior capture continuous video of the road, pedestrians, cyclists and other vehicles. Lidar systems emit millions of laser pulses per second to build precise three-dimensional maps of the surroundings. Radar sensors track the speed and position of nearby objects. This data is used to refine and train the vehicle’s AI systems — and companies retain it, in various forms, long after the journey ends. Understanding how robotaxi sensor systems work helps clarify just how comprehensive that picture is.
Location and journey data tracks every aspect of the route. GPS records precise coordinates throughout the trip. The vehicle’s navigation systems log pick-up and drop-off points, travel time and any route variations.
Passenger account data is collected through the booking app. This typically includes name, email address, phone number, payment details and a complete history of every trip taken. Waymo’s published privacy policy lists geolocation data, device identifiers, app usage behaviour and — in some circumstances — sensitive personal information including health data and demographic characteristics.
In-vehicle recording adds another layer. Interior cameras are standard in most operational robotaxi fleets, monitoring passenger behaviour for safety and security purposes. Some operators record audio during support calls initiated inside the vehicle.
How Companies Use Your Data
Robotaxi operators use collected data for several stated purposes. The primary use is improving the autonomous driving system itself: every kilometre driven, every sensor reading captured and every edge case encountered feeds back into the machine learning systems that make these vehicles safer over time.
Waymo’s privacy policy also lists fraud detection and prevention, personalised advertising and legal compliance as purposes for retaining passenger data. The inclusion of targeted advertising is a detail many passengers would not expect from what appears to be a straightforward taxi journey. Ride data can be used to build a profile of movements, habits and preferences — and that profile has commercial value.
For Australians, this matters because public trust in autonomous vehicles is still developing. Transparency about data practices is one of the key factors in whether people are willing to step into a driverless vehicle for the first time.
Who Else Gets Access?
The data collected during a robotaxi ride does not necessarily stay with the operator. Waymo’s privacy policy identifies several categories of third-party recipients: service providers acting on the company’s behalf, advertising partners for targeted campaigns, entities involved in corporate mergers or acquisitions, social media platforms with user consent and law enforcement agencies when legally required.
That last category is particularly significant. A robotaxi’s data — including GPS logs, interior camera footage and passenger identity — could be requested by police or other government agencies with appropriate legal authorisation. The vehicle’s data could place a passenger at a specific location at a specific time with a precision that no traditional form of transport provides.
The cybersecurity risks of robotaxi data systems create a further dimension. Data held centrally by a large technology company is also a target for malicious actors, and a breach affecting passenger records would have significant privacy implications.
What Australian Privacy Law Currently Requires
The Privacy Act 1988, administered by the Office of the Australian Information Commissioner (OAIC), is the primary framework governing how organisations collect, use and store personal information in Australia. It applies to most private sector organisations with annual turnover exceeding $3 million — a threshold that every major robotaxi operator would comfortably exceed.
The Act’s 13 Australian Privacy Principles (APPs) set out the core obligations. APP 3 requires that organisations only collect information that is reasonably necessary for their functions, with stricter rules for sensitive data such as health information or biometric data. APP 5 requires that individuals be notified about the purpose of collection at or before the time it occurs. APP 6 limits use and disclosure to the primary purpose of collection, or to circumstances where the individual has given consent.
APP 8 is directly relevant to robotaxi operators based overseas. It requires organisations to take reasonable steps to protect personal information before sharing it with overseas recipients. Robotaxi companies headquartered in the United States that would process Australian passenger data on servers outside the country must comply with this principle.
Under APP 12, Australians will have the right to ask any robotaxi operator exactly what data it holds about them. Under APP 13, inaccurate information must be corrected on request.
The Gap Between Policy and Practice
The uncomfortable reality is that when robotaxi operators eventually launch in Australia, their existing privacy policies will not mention Australian law. Waymo’s published policy currently addresses residents of California, Virginia, Texas, the European Union, Canada and the United Kingdom by name — Australia does not appear.
This means that until Australian-specific operations launch and local regulatory frameworks are in place, passengers would be relying on general Privacy Act obligations rather than any robotaxi-specific protections. The National Transport Commission’s ongoing regulatory work on automated vehicles has not yet published specific guidance on data governance for robotaxi passengers.
By contrast, the European Union’s General Data Protection Regulation already applies to autonomous vehicle data, with strict requirements around consent, data minimisation and the right to have data deleted. Australia’s Privacy Act reform process — currently under review — may introduce similar principles, but the timeline for those changes remains uncertain.
What to Look for Before You Ride
When robotaxi services arrive in Australia, there are several data practices worth examining before stepping into a vehicle.
A transparent privacy policy published in plain English is a minimum expectation. Under the Australian Privacy Principles, operators are required to maintain a clearly expressed and up-to-date privacy policy — but the level of detail varies considerably between operators. A policy that addresses data retention periods, the specific categories of sensitive data collected and how long in-vehicle footage is stored is a reasonable standard to expect.
Data minimisation matters. Environmental sensor data used to operate the vehicle safely serves a fundamentally different purpose from passenger identity and journey history used for commercial ends. The two categories should be subject to different retention and sharing rules.
The right to opt out of non-essential data uses — particularly targeted advertising — is something Australian passengers should expect under APP 7, which restricts direct marketing to circumstances where the individual has consented or specific legal conditions apply.
Questions about data retention after an incident will also need clear answers. If a robotaxi is involved in a crash or emergency, the data it holds could be critical evidence. The question of who is liable in a robotaxi incident and who controls the data relating to that incident are closely linked — and both remain unresolved in the Australian context.
When Will Clear Rules Be in Place?
Australia is still developing a regulatory framework for autonomous vehicles on public roads. The conditional deployment of driverless vehicles under Commonwealth law is expected to become possible during the late 2020s, with states and territories responsible for the specific road rules governing where and how they operate.
Data privacy protections for robotaxi passengers are likely to emerge through a combination of the existing Privacy Act framework, conditions attached to vehicle deployment approvals and new regulations developed as part of the NTC’s Automated Vehicle Program. Whether those protections will match the stronger standards already in place in Europe remains an open question. The broader safety case for autonomous vehicles is well established in the data — but data safety and passenger data privacy are two distinct conversations, and Australia will need to address both.
The data practices that become normalised in the United States, Japan and Europe today will shape what arrives on Australian roads tomorrow. Staying informed is the most practical thing Australians can do in the meantime.