Mozilla's concentrated efforts took a while, they're right that it's hard to figure out exactly what car manufacturers are doing. Unless you're willing to sue a bunch of them, plain GDPR requests won't be enough to get this information. Companies will happily lie or declare information collected as "non-personal" or "trade secrets" and if they're smart enough about the way they process their data they can probably convince a judge that the end result isn't personal enough that exposing their trade secrets weighs up against the GDPR.

There's no way even a large news corporation is going to buy every model car from every brand that comes out in a year to get the legal rights to demand data, let alone pursue these data requests in court. Renting cars may be easier, but then your contract is with the rental company and they're responsible for getting you the information you require, and after the first three PII requests you're not going to be renting from them any time soon.

I'm not saying they couldn't do a deeper dive with more detailed research, but it's not an easy task to evaluate an industry like this. All they'll be able to produce is general statements about a limited set of car models that'll quickly be outdated once the next software update comes out.