Probably nothing? Because they're pretty good at cheating the rules so they don't get caught. Occasionally they get caught, but you know how it is: if you find one cockroach in your food, that probably wasn't the only cockroach in the restaurant.
As far as I can tell, German companies are very good at keeping their shenanigans under wraps because they know that being caught has terrible consequences. Occasionally they slip up and then you see what a complex conspiracy they've been operating.
German regulators are notoriously understaffed, see 'Wirecard'. I would not be surprised if there were no consequences at all until it hit the press or someone in a position of power was embarrassed.
Missing Wirecard seems to be a product of arrogance and incompetence. Under-staffing could have caused the regulator to overlook the fraud, but the continued obstinacy of the regulators in the face of overwhelming evidence was incompetence. Attempting to prosecute the journalists revealing the fraud was incompetent arrogance.
> I would not be surprised if there were no consequences at all until it hit the press or someone in a position of power was embarrassed.
At which point the Data Protection Authorities (GDPR enforcement) would get involved. They would almost certainly levy a hefty fine against the auto manufacturer.
Given similar circumstances to what? Having a camera that is off by default and where it is up to the user whether to turn it on or not? What exactly is the problem?
The important question is: what would the consequences be to a German car manufacturer given similar circumstances?