For the avoidance of doubt, for purposes of this Privacy Policy, “using” the Services includes being a Vehicle Occupant in a Connected Vehicle.
In section 2, “Information We Collect”, it says:
Identifiers - A real name, username or alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, vehicle information (such as model and year), vehicle identification number (VIN), vehicle telemetry data, or other similar identifiers.
Other Personal Information subject to certain laws - A name, signature, Social Security number, address, telephone number, driver’s license or state identification card number. Some Personal Information included in this category may overlap with other categories.
Commercial information - Records of personal property, products or services purchased, obtained, or considered.
Internet or other similar network activity. - Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.
Geolocation data. - Physical location and movements, including from Connected Vehicle Services or Technology Services.
Inferences drawn from other Personal Information. - Profile reflecting a person’s preferences, characteristics, predispositions, behavior, or attitudes.
Recordings - Audio recordings of Vehicle Occupants. Audio recordings when you call our call centers or a Retailer.
Payment information - Credit card information for optional Services, such as Subaru Starlink.
You can opt out of Subaru Starlink, but all that does is turn off the benefits the owner of the vehicle would get. It doesn’t disable the collection of information and recordings and such. (If you never paid for Subaru Starlink, this would probably prevent them from having your payment information, I guess.)
About your concern about kids, they have this to say:
Subaru’s Service is intended for a general audience and not directed at children under (13) years of age.
We do not knowingly gather Personal Information (as defined by the U.S. Children’s Privacy Protection Act, or “COPPA”) in a manner not permitted by COPPA. If a person under 13 submits Personal Information through any part of a Subaru Service, and we learn the person submitting the Personal Information is a child, we will attempt to delete this Personal Information as soon as possible. If you are a parent or guardian and you believe we have collected Personal Information from your child in a manner not permitted by law, contact us as set out in the “Contact Us” Section below. We will remove the data to the extent required by applicable laws.
So, basically, they’re going to collect until you call and tell them why it’s not legal. Until then, they’ll assume they’re not breaking any laws.
But then again, it’s entirely likely you don’t have a Subaru and don’t really care about Subaru specifically. If that’s the case, I highly recommend this page on Mozilla’s site where you can go to look more into most popular car brands’ privacy practices. Soiler alert: none of the 25 popular car brands they evaluated are much better than Subaru. And many are worse.
Whatever the case, it’s pretty clear that whether they’re “allowed to” or not, they do it.
And cars aren’t the only concern. Robot vacuum cleaners for instance are an issue. (Also, don’t believe a robot vacuum company when they say "this model doesn’t have a camera, it only has an “optical sensor.” If this interests you, see this talk.) And smart TVs. Just for instance.