CarPlay is essentially a form of AirPlay, so the car is receiving a video stream from your phone, not data. (Of course, they could try to extract data from the video stream, but I doubt they have the technical skills to do that in the near future.)