They cannot tap into car data if the car doesn't record data. People must know that they get in cars that are capable of doing that.
I doubt my 2015, Skoda can record any data as it barely has electric windows. Surely if it doesn't have Onstar or whatever it's called now, it cannot be recording data. Perhaps people were unaware that their data was going to be available to these companies but they did know at some level that the data could be recorded. It's like buying a house with security cameras and then never wondering where the security cameras lead.
People have a blind spot for cars though, since it isn't connected to any wires, they feel as if it can't possibly be network connected, but of course it can.