A dashboard screen and a built-in cellular connection have quietly turned the family car into one of the more thorough data-collection devices most households own. Every trip, every hard stop, and often every location a vehicle visits gets logged somewhere inside its systems, and very little of that logging requires the driver to opt in first.
What a connected car collects by default
That shift happened gradually enough that most drivers never made a single deliberate decision to accept it. A car bought a decade ago with a basic navigation screen has, in many cases, been replaced by a newer model built around a permanent cellular connection, and the jump from “a car with a screen” to “a car that reports home continuously” happened one ordinary trade-in at a time rather than through any single announcement drivers could have reacted to. A modern connected car uses an embedded cellular modem and a network of onboard sensors to continuously gather data on location, speed, braking behavior, acceleration patterns, and in many cases even how a driver interacts with infotainment features, all without requiring a separate app or subscription to activate the collection itself. Automakers built these systems primarily to support features drivers do want, such as remote start, stolen-vehicle tracking, and automatic crash notification, but the same pipeline that powers those features also captures far more granular behavioral detail than most owners realize is being recorded in the background.
Where that data has ended up
That granular detail hasn’t always stayed inside the automaker’s own systems. Federal regulators found that at least one major automaker’s connected-service data made its way to consumer reporting agencies, which then resold driving-behavior profiles to insurance companies that used them to help set individual policy premiums, turning a feature drivers signed up for convenience into a pipeline that could raise their insurance costs without their direct knowledge. Once that kind of data leaves the vehicle, tracing every downstream buyer becomes far harder for the original owner than tracing where the data started.
The FTC case that exposed how it was being sold
The clearest public accounting of how this works came from a federal enforcement action against General Motors and its OnStar connected-vehicle service. The Federal Trade Commission finalized an order in January 2026 settling allegations that GM and OnStar collected and sold consumers’ precise geolocation and driving-behavior data without adequately notifying drivers or getting their informed consent, using an enrollment process the agency said obscured what customers were actually agreeing to. The final order bars GM from sharing that kind of data with consumer reporting agencies for five years and requires the company to obtain clear, affirmative consent before collecting, using, or sharing connected-vehicle data for the full twenty-year life of the order.
The legal gray area around who owns it
Ownership of the data itself remains murkier than most drivers would expect. Federal law generally treats the data captured by a vehicle’s dedicated event data recorder, the component built specifically to log crash-related details, as belonging to the vehicle’s owner or lessee, inaccessible to outside parties without consent or a court order. But the much larger stream of telematics data generated continuously by a connected car’s broader systems doesn’t fall under that same clear framework, and no single settled rule determines who owns it once it’s collected, which is part of why regulators have leaned on consent and disclosure requirements rather than a straightforward ownership standard.
What drivers can do to limit collection
Owners aren’t entirely without options, even without a uniform ownership law to fall back on. Most connected-service programs allow drivers to review and adjust data-sharing settings through the automaker’s companion app or account portal, including the ability to disable optional features like driver-scoring programs that specifically feed behavior data to third parties. Reading the terms presented during a connected-services enrollment, rather than accepting the default settings during a dealership handoff, remains the most direct way for an owner to understand what a given vehicle is set up to collect before it starts happening automatically in the background.
The GM order gives a preview of where regulators appear headed on this broader question: toward requiring clear, affirmative consent before connected-vehicle data can be collected or shared, rather than leaving the burden entirely on individual drivers to dig through an app’s settings menu. Until that kind of consent requirement becomes standard across the industry rather than the result of a single company’s enforcement action, the practical responsibility for limiting what a car reports still falls mostly on the owner willing to go looking for the controls.
Why Insurers Wanted This Data In The First Place
None of this data would have found a market if insurers had not already spent years building a business model around it. Usage-based insurance programs, marketed to customers as a way to earn a discount for demonstrably safe driving, were the original justification for collecting granular trip-by-trip behavior in the first place, predating the connected car by roughly a decade through plug-in dongles and standalone phone apps that customers opted into directly with a single insurer. A connected vehicle’s built-in telematics system simply made that same kind of monitoring passive and continuous instead of something a driver had to actively install, which is part of why so many owners never registered it as the same category of tracking they might have recognized from an insurer-branded gadget plugged into the dashboard. The complication is that a factory-installed system routes the data through the automaker and a third-party broker first, rather than directly to a single insurer a customer chose to work with, which is what let the data reach companies and policies the original driver never selected and had no direct relationship with at all.
This article was produced with the assistance of AI and reviewed by Morning Overview editors.
More from Morning Overview
