The modern car has quietly become one of the most data-hungry devices a person owns, a computer on wheels that logs far more than most drivers realize. Newer vehicles continuously record where they go, how they are driven and, when a phone is connected, information drawn from that phone as well. Much of this happens in the background, governed by consent buried in enrollment screens and privacy policies that few people read, and in some cases the information has been packaged and sold to outside companies.
This is no longer a hypothetical concern raised only by privacy advocates. Federal regulators have taken formal action against a major automaker for collecting and selling drivers’ data without proper consent, and independent reviews have concluded that the auto industry as a whole handles personal information worse than almost any other consumer product category. The result is a growing reckoning over just how much a car knows about the person behind the wheel.
What a connected car actually records
The data a modern vehicle gathers goes well beyond a simple location fix. Cars equipped with connected services can log precise geolocation over time, along with detailed driving behavior such as speed, hard braking and rapid acceleration, the kind of granular record that can be used to reconstruct a person’s routines. When a smartphone is paired to the infotainment system, the car can also ingest data from the phone, including contacts and call logs, which is the basis for the claim that a vehicle can register not just where a person drives but whom they communicate with. Forensic specialists have long been able to extract this paired-phone information from vehicle systems, a capability that has featured in law enforcement investigations.
Independent scrutiny of the industry has been damning. A review by the Mozilla Foundation examined the privacy practices of major car brands and concluded that cars were the worst category of product it had ever evaluated for privacy, with every brand assessed failing to meet basic standards. The organization pressed automakers to answer for how much they collect and how little control drivers are given, and found the industry’s responses largely unsatisfying.
The case that proved data was being sold
The most concrete evidence that this data leaves the car came from a federal enforcement action against General Motors. The Federal Trade Commission alleged that GM and its OnStar unit collected drivers’ precise geolocation and driving behavior data from millions of vehicles and sold it to third parties, including consumer reporting agencies, without adequately informing consumers or obtaining their consent. According to the agency, GM used a misleading enrollment process that steered drivers into signing up for a connected service and a driver-scoring feature without clearly disclosing that their detailed driving data would be gathered and shared.
The significance of selling this information to consumer reporting agencies is that such data can feed into the risk models insurers use to set premiums. Drivers reported seeing their insurance costs rise without understanding that their own cars had been quietly reporting how they drove. The episode transformed an abstract privacy worry into a tangible financial harm, showing how telematics data could follow a person into their insurance bill.
What regulators required
The GM matter moved from allegation to binding order. The FTC finalized a settlement that bars the company from disclosing consumers’ geolocation and driver behavior data to consumer reporting agencies for five years, and, for the two-decade life of the order, requires the company to obtain affirmative express consent before collecting, using or sharing connected vehicle data. The order also obliges the company to let drivers obtain and delete the data collected about them, restoring a measure of control that the enrollment process had bypassed.
Those terms are notable because they set an explicit standard for how connected vehicle data should be handled: clear, affirmative consent rather than consent inferred from a confusing sign-up flow. While the order applies to a single automaker, it functions as a warning to the rest of the industry about the practices regulators are prepared to challenge.
A pattern beyond one company
The concern is not limited to a single manufacturer. Members of Congress who investigated the industry found that the sharing of driver data extended to other major automakers as well. A letter from Senators Ron Wyden and Edward Markey reported that several automakers had disclosed drivers’ data to a data broker, including details such as acceleration and braking, and urged the FTC to investigate the industry’s practices more broadly. The senators’ findings suggested that the GM case was an example of a wider business model rather than an isolated lapse.
That pattern matters because it reframes the issue from the conduct of one company to a structural feature of how connected cars are monetized. When multiple manufacturers are found routing driving data to brokers, the problem becomes an industry norm that individual drivers have little visibility into, reinforcing the case for stronger disclosure requirements across the board.
What drivers can do about it
For owners uneasy about the trail their vehicle generates, there are steps that reduce it, though none are as simple as a single switch. Many automakers offer connected-services accounts where data-sharing and driver-scoring features can be reviewed and, in some cases, turned off, and drivers can decline optional programs during purchase or setup. Deleting paired-phone data from the infotainment system, particularly before selling or returning a vehicle, prevents contacts and call logs from lingering in the car’s memory.
The broader remedy, as the enforcement actions suggest, lies in stronger rules and clearer consent rather than in individual vigilance alone. Regulators have signaled that they expect automakers to make data practices transparent and to give drivers real control, and the outcome of the GM case establishes a template for what that control should look like. Until such standards are universal, the safest assumption for any driver of a newer vehicle is that the car is recording more than it appears to, and that understanding its settings is now part of owning it.
This article was produced with AI assistance and reviewed by Morning Overview editors.
More from Morning Overview
