The car you drive to work knows how hard you braked at the last intersection, whether you were speeding on the highway, and what time you got home last night. It knows which apps you connected to its infotainment system, where you stopped for gas, and whether you were wearing your seatbelt. Most people have a vague sense that connected cars collect data, the same way they have a vague sense that their phones do, but the specifics are more invasive than most owners have ever been told, and the buyers of that data are not always who you might expect.
This didn't happen all at once. Vehicle telematics systems became common about a decade ago, and the practice of systematically monetizing the data they collected took off around five years ago, according to the Mozilla Foundation, which spent 600 hours in 2023 analyzing the privacy practices of 25 car brands. What they found was damning enough that they named cars the worst product category they had ever reviewed for privacy, worse than smart speakers, fitness trackers, or social media apps. Understanding how we got here requires following the money, and the money leads somewhere most drivers didn't see coming.
How Your Car Became a Data Product
Modern vehicles are essentially rolling sensor arrays. Onboard cameras monitor your face and eye movements, GPS logs every route, telematics systems track acceleration and braking patterns, and infotainment systems vacuum up data from every connected phone and app. The Mozilla Foundation found that 84% of automakers share or sell user data to third parties, and 92% offer limited to no meaningful user control over what gets collected. The privacy agreements governing all of this exist, but they are written in language long enough and complex enough that the consumer who reads them in full before signing is essentially nonexistent.
Automakers have framed data collection primarily as a safety and convenience feature, and some of it genuinely is. Real-time navigation, remote diagnostics, and emergency crash response are real benefits that depend on real data. The problem is that the infrastructure built to deliver those features is also capable of capturing everything else, and the financial incentive to monetize that additional data is enormous. Industry analysts and data brokers have described individual driving data as the new oil, and the automakers paying attention to those projections built systems that could supply it.
The consent process has been the central failure. Consumer Reports reviewed thousands of pages of privacy policies from 15 major automakers and found that many vehicles capture your agreement to data collection through the infotainment system startup screen, meaning owners who simply tap through the setup process on the day they pick up their new car may have agreed to data sharing without realizing it. Almost every automaker Consumer Reports contacted declined to name the specific companies they share driving data with, which gives a reasonably clear picture of how transparent the industry wanted to be.
The GM Case Made It Concrete
The most documented example of how far automotive data collection can go involves General Motors and its OnStar subsidiary, and the story is specific enough to cut through the abstract. Starting around 2021, GM enrolled drivers in a feature called Smart Driver through a process the Federal Trade Commission later described as misleading. The feature collected precise geolocation and driving behavior data, including every hard braking event, speeding incident, and late-night trip, sometimes as frequently as every three seconds. That data was then sold to data brokers LexisNexis and Verisk Analytics, which sold it in turn to insurance companies to adjust premiums.
One GM driver in Florida, Temeika Clay, discovered her car insurance had spiked 80% after GM sold 603 individual driving events logged from her Chevy Camaro to data brokers without her knowledge. The FTC filed its complaint in January 2025 and finalized a sweeping order against GM and OnStar in January 2026, issuing what former FTC Chair Lina Khan called an appropriate response to an egregious betrayal of consumer trust. The order imposes a five-year ban on GM sharing geolocation and driver behavior data with consumer reporting agencies, requires explicit opt-in consent for future collection, and mandates the deletion of previously gathered data. GM had already discontinued the Smart Driver program in April 2024 after a New York Times investigation brought it to public attention, and has since accrued $300 million in Q3 2025 for investigations and litigation related to the program.
What You Can Actually Do
The legal framework for protecting yourself is real but uneven. Under state privacy laws, some automakers allow owners nationwide to request data deletion, opt out of sharing, or review what has been collected, while others limit those options to residents of states with applicable laws. Privacy4Cars, an automotive privacy company founded by Andrea Amico, offers a free vehicle privacy report at vehicleprivacyreport.com where owners can enter their Vehicle Identification Number and get a summary of what their specific car collects and who it shares that information with. The service can also file opt-out requests with automakers on your behalf.
The practical trade-off is real. Turning off location tracking on many vehicles also disables roadside assistance, remote door locking, and other features that are genuinely useful. Consumer Reports recommends reading your vehicle's privacy policy before purchase, adjusting data settings in the infotainment system where possible, and filing formal data requests if you want to know what's already been collected. The leverage consumers have is still limited. What the GM case demonstrated is that the market will not self-correct here, and until federal legislation catches up with the technology, the default position of your car is collection, not protection.
