Smart technologies built into new Toyota cars are collecting personal data and potentially sharing it with insurance companies and other groups, consumer advocate group Choice has found.

Toyota has insisted it takes customer privacy “extremely seriously”, but has acknowledged the data communication module (DCM) – known as the “Connected Services” feature – can only be disabled but not removed from its cars, or else drivers could void their warranty and render Bluetooth and speakers non-functional.

Following an investigation, Choice has found Toyota’s “Connected Services” feature “collects information such as vehicle location, driving data, fuel levels, and even phone numbers and email addresses”.

• Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup

“Car companies say these technology features increase driver safety, but in a world of data hacks and sharing, it’s just another way for companies to gather valuable information, whether consumers like it or not,” Choice’s senior campaigns and policy adviser, Rafi Alam, said.

“Concerningly, Toyota’s Connected Services policy says if you do not opt out, it will collect and use personal and vehicle data for research, product development and data analysis purposes,” he said.

“It may also share the data with third parties, such as debt collectors or insurance companies. Toyota says it needs consent to share your information in some cases but Toyota’s policies are incredibly vague about what actually counts as ‘consent’.”

A Choice investigation found one customer, Matthew, claimed he only learned about the Connected Services feature a few months after buying his $68,000 Toyota HiLux when he began receiving emails asking him to register for it.

Feeling uncomfortable about the feature, the Queensland father asked the dealership to remove – not just deactivate – the technology from his car, but claimed he was told this would void the warranty and risk his insurance.

He ultimately never picked up the car and cancelled his order, but claims the dealership is refusing to refund his $2,000 deposit.

Alam said privacy problems are becoming a widespread concern with cars, “as just about every new vehicle seems to have a ‘smart’ connection installed”. He called on the federal government to bolster safeguards and introduce prohibitions on the collection and use of personal data as a matter of urgency.

“People shouldn’t have to give up their privacy rights in order to purchase a new car,” Alam said.

A Toyota Australia spokesperson said the company took customer privacy “extremely seriously”.

“The standard process is to inform customers of the connected services feature as part of the sales contract, which includes information about connected services, and to ask them to sign confirmation they have been informed and agree to those services being activated,” Toyota said.

“Customers are free to opt out of these services at any time using a form available at any Toyota Dealer. Disconnection occurs by disabling the DCM SIM card. On request, Toyota dealers can facilitate disconnection.”

The spokesperson said that while disconnecting the sim card would not void the warranty, a customer who elected to physically remove the DCM with a third party – because Toyota won’t – “does so at their own risk”.