The Vehicle Privacy Report creates privacy labels under two broad categories: what a manufacturer collects (including identifiers, biometrics, location, data from synced phones, and user profiles) and whom a manufacturer sells or shares data with (affiliates, service providers, insurance firms, government, and data brokers). For the vast majority of cars and trucks released in the past few years, it’s likely that most types of data are collected.
I think several years ago there was some company that unlocked the car’s full potential for 1/2 of the price of the original update. I don’t remember their name nor what happened to them but they probably got sued
An open source hack I think would be legal. Selling it could violate a few laws. Especially because some of the safe guards are like legal things.