Your car knows more about you than your smartphone does. It tracks where you go, how fast you drive, when you brake hard, how long you idle outside a particular address, and sometimes what you say inside the cabin. And in a growing number of cases, that information flows far beyond the automaker that built the vehicle — reaching insurers, advertisers, and data brokers, the commercial middlemen who buy and resell personal information for profit.
The Federal Trade Commission noticed. Earlier this year, the agency took formal action targeting the connected vehicle data industry, marking one of the most significant regulatory confrontations with automotive privacy practices in recent memory. What that scrutiny revealed should concern every driver on the road today.
How Modern Cars Collect Data About You
Pull out of your driveway in a vehicle built in the last five years and you are almost certainly being monitored. Modern automobiles function as rolling data centers, equipped with telematics systems — onboard hardware that transmits driving and location data in real time. Analysts at McKinsey estimated that by 2025, more than 90 percent of new vehicles sold globally would be connected in some form, with telematics embedded at the factory level rather than added as an optional feature.
The collection is relentless and remarkably detailed. Telematics systems log GPS coordinates continuously, often at intervals of a few seconds. Accelerometers record every aggressive acceleration and hard stop. Cameras and sensors designed for driver-assistance features can capture the environment around the vehicle and, in some configurations, the driver's face and eye movements. Infotainment systems linked to smartphones harvest contact lists, call histories, and app usage patterns through Bluetooth and USB connections. Even mundane behavior — parking near a particular store repeatedly, sitting in a driveway late at night — produces patterns that are commercially valuable when aggregated.
Automakers frame this collection as essential for safety improvements, warranty diagnostics, and delivering personalized in-car experiences. That framing is not false. But it is incomplete.
Where Your Car's Data Goes After Collection
The destination of that data is where car data privacy becomes genuinely alarming. Automakers do not simply hold what they collect. They share it, license it, and sell it through complex chains of third-party agreements that most drivers will never read.
Read next Top Technology Trends in 2026 You Need to KnowMozilla Foundation's Privacy Not Included project, which systematically evaluates consumer products on privacy practices, published a devastating review of major automakers in 2023. Researchers found that the majority of car brands studied collected far more personal data than necessary for vehicle operation, shared data with third parties including data brokers, and gave drivers little to no meaningful control over what was collected or where it went. Several brands reserved the right to share data with law enforcement without requiring a warrant, relying instead on internal policy decisions.
Data brokers — companies whose entire business model is purchasing, packaging, and reselling personal information — are eager buyers. Location data derived from vehicle telematics has been sold to insurers who use it to reprice premiums based on driving behavior, sometimes without drivers knowing their coverage was being evaluated. Advertisers purchase aggregated mobility data to understand foot traffic patterns and target drivers based on where their vehicles regularly appear.
The FTC Steps In: Regulatory Scrutiny of Automotive Data
The Federal Trade Commission's involvement represents a turning point. Earlier this year, the agency moved against practices in the connected vehicle data market, a signal that federal regulators now view automotive data as a serious consumer protection issue, not a niche technology concern.
The FTC has previously published detailed staff reports on connected vehicles and data brokers, establishing a factual record about how data flows from cars to commercial buyers. Those reports documented the opacity of data-sharing arrangements, the inadequacy of consent mechanisms buried in terms of service, and the practical impossibility of drivers opting out of systems that are built into the vehicles they drive every day.
The Electronic Frontier Foundation, a digital rights organization that has tracked connected vehicle surveillance for years, has argued that the core problem is structural: automakers designed data collection into their products as a revenue stream from the start, and retrofit privacy controls are inherently weaker than privacy-by-design would have been.
Regulatory pressure in Europe has moved faster. The General Data Protection Regulation imposes strict requirements on the collection and processing of location data, and European regulators have fined companies for violations. The United States has no equivalent federal privacy law, leaving the FTC to work with existing consumer protection authority — a narrower tool.
Real-World Consequences of Vehicle Data Sharing
Abstract privacy concerns become concrete quickly when you trace specific consequences. Insurers in several states have used telematics data to retroactively adjust premiums after customers enrolled in so-called safe driver programs, sometimes delivering rate increases to drivers who believed they were earning discounts. Investigative reporting has documented cases where driving data collected without explicit informed consent was used in rate decisions.
Law enforcement agencies have sought vehicle location records from automakers and their data broker partners, sometimes without warrants, relying on the legal doctrine that information voluntarily shared with a third party carries diminished privacy expectations. A driver who consented broadly to data sharing in an automaker's terms of service may have inadvertently waived certain legal protections they did not know they had.
Domestic abuse advocates have raised particular concern. Location data derived from a vehicle's telematics system can reveal a survivor's shelter, workplace, or the addresses of people helping them — information that could be accessed by an abusive partner through commercial data broker services that sell location lookups for a small fee.
How to Protect Your Privacy in a Connected Car
The options available to drivers are real, if limited. Start by reading the privacy settings available in your vehicle's infotainment system. Most connected vehicles include a menu, sometimes labeled "data sharing" or "connected services," where certain collection and transmission functions can be restricted. The Electronic Frontier Foundation recommends reviewing these settings when you first acquire a vehicle and revisiting them after software updates, which can reset permissions.
Opt out of every optional data-sharing program your automaker offers. Programs marketed as diagnostic improvement or personalization features often involve the broadest data sharing. Declining them typically costs nothing in terms of core vehicle functionality.
Be deliberate about smartphone connections. When you pair your phone to a vehicle via Bluetooth or plug it in via USB, the infotainment system can request access to contacts, call logs, and applications. On both iOS and Android, you can review and revoke these permissions after the fact. Removing old vehicle pairings from your phone's Bluetooth memory is also good practice when you sell or return a vehicle.
Request a copy of the data your automaker holds. In states with privacy laws that grant data access rights — California's Consumer Privacy Act is the most prominent example — automakers are legally required to fulfill these requests. Reviewing what they have collected reveals the actual scope of surveillance and may surface data you can request be deleted.
Finally, scrutinize any insurance program that involves a plugin device or app-based monitoring. Read the data-sharing terms before enrolling, and understand that the information collected may be shared beyond the insurer itself.
The Road Ahead: Data Privacy and the Future of Driving
The trajectory is toward more data collection, not less. Autonomous and semi-autonomous vehicles require continuous sensor fusion — combining camera, radar, lidar, and GPS inputs — producing data volumes that dwarf what today's connected cars generate. Automakers are building software platforms designed to generate recurring subscription revenue, which creates powerful financial incentives to mine driver data for advertising and licensing opportunities.
The FTC's action this year is significant precisely because it establishes that car data privacy is within the scope of federal consumer protection enforcement. But regulatory action alone has historically been insufficient to change industry behavior without accompanying legislation that sets clear rules before products are designed rather than litigating violations after the fact.
Drivers are not powerless, but they are operating in a system designed to collect first and explain later. The most important step is refusing to treat privacy settings as fine print. Your car knows where you live, where you worship, where your children go to school, and how you spent last Thursday night. That knowledge has monetary value. Understanding who profits from it is the first step to deciding whether you are comfortable with the arrangement.
Source: The Verge
