That Mozilla Foundation report on Vehicle and Personal Data Security really makes me want to stay away from Sirius XM as it's one of the main ways that personal data is collected and shared.

From Sirius XM's Privacy Policy

quote:
3. Summary of Sirius XM Key Personal Data Practices

This section presents a summary of our key personal data practices. Please see the Sirius XM Data Collection and Use Table at the end of this Policy to review details about the (1) categories of personal data we collect, (2) purposes for which we collect that information, (3) categories of third parties to whom that information may be disclosed for a business purpose and (4) categories of third parties to whom the information may be sold for monetary value or other valuable consideration or shared for cross contextual behavioral advertising/targeted advertising. We encourage you to read the Table carefully

We collect personal data about you from you directly, automatically through your use of the Services, and from third parties. The categories of information we collect that may be considered “personal data” under applicable law include: 1.Registration Data, 2.Vehicle Data, 3.Payment Data, 4.Sensitive Personal Data, 5.Other Demographic Data, 6.Transaction Information, 7.Listening Preferences, 8. Account Information and Settings, 9.Device Data, 10.Audio and Visual Data, 11.Geolocation Data (including precise geolocation with your consent). We use this information to facilitate your access to the Services, to manage your account and subscriptions, to personalize your listening, marketing and advertising experiences, and to send you information from us or on behalf of certain third parties. Please review the “Additional Details About our Data Practices” section for more information. We may also use personal data about you to troubleshoot and improve the Services, to develop new products and services, and to maintain and protect our systems and your personal data. If you access the Services using an in-vehicle SiriusXM radio, please also review the “Supplemental Information for Users of SiriusXM In-Vehicle Services” section for in-vehicle specific information.

We may share your personal data for business purposes with our subsidiaries, third party service providers, vendors and licensors, other Sirius XM users when you provide access to your subscription, and unaffiliated third-party business relationships for business and advertising purposes. For more details, please review “Disclosures to Third Parties” section. Please note, if you choose to participate in community forums and similar features on the Services or make requests to on air hosts, the information you share will become public.

Sirius XM engages third party businesses for a variety of business and commercial purposes, including service providers of technology, customer care support, marketing, and payment processing. Sirius XM works with advertisers, advertising agencies, and providers of ad-related services such as attribution, measurement, and analytics, who may set and access their own tracking technologies (like cookies tags or pixels) on your device. They may use this information to serve and measure performance of ads for the Services when placed on third party publishers and channels, to serve and measure performance of third party advertisers’ ads on the Services, and to provide us with information regarding the use of the Services and the effectiveness of ads. For more information, including your opt-out choices, please review the “Third Party Advertising and Analytics/Privacy Controls” section and the information set forth in the Table at the end of this Privacy Policy. This practice may be considered sale or regulated sharing under certain US state laws and residents of those states may have additional rights. For more information, please review the “State Specific Rights” section.

And unless you're in select states, you have no right/control over that data.

quote:
Your Rights
Access Your Information/Obtain Your Information/Data Portability (CO, CT, UT, VA Residents) –You have the right to confirm whether we are processing your personal data and request to access such data, obtain a copy of the personal data previously provided by you to us and, to the extent feasible, in a readily usable format to allow data portability.

Delete Your Information (CO, CT, UT, VA Residents). You have the Right to request the deletion of your personal data, subject to certain exemptions and exceptions.

Correct Your Information (CO, CT, VA Residents). You have the Right to correct the personal data we hold about you.

Sensitive Data. If you are a Virginia, Colorado, or Connecticut resident, to the extent Sirius XM processes sensitive data, we will obtain your consent to the processing of any Sensitive Data (as defined by the applicable state law) before any such data is collected. You may also opt out using the methods to exercise your rights listed below in this section. Commencing December 31, 2023, Utah residents shall have the right to opt out of the processing of Sensitive Data, each as defined by Utah law, to the extent that Sirius XM processes any such data.

Opt-Out of Sale of Your Personal Data and Targeted Advertising (CO, CT, VA and UT residents) - CO, CT, VA, and UT residents have the right to opt-out of “Sale” of personal data or from the use of personal data in “Targeted Advertising”

This post was edited on 9/8/23 at 10:51 am