Your car is selling your data

The debate over vehicle data privacy intensified after the Federal Trade Commission penalized General Motors with a five-year restriction on selling customer information to consumer-reporting agencies and third-party brokers. Investigations showed GM had been gathering granular driving metrics — such as speeding frequency and nighttime driving — and sharing them with firms that help produce insurance risk profiles. Many vehicle owners unwittingly enabled that collection when they accepted connected services like OnStar’s Smart Driver, and some later reported higher insurance bills tied to those data feeds.

Researchers and consumer advocates say GM’s case is not unique. A Mozilla Foundation study of major automakers’ privacy policies in 2023 concluded that industry practices around privacy and security were broadly poor, and Consumer Reports found that nearly every automaker selling cars in the U.S. collects and shares so-called driver behavior data. Part of the difficulty for consumers is that vehicle data flows through multiple agreements — the carmaker, the connected-services provider, the mobile app and even the finance company — making it far harder to find and change privacy settings than on a smartphone.

Policymakers have offered different responses, but privacy advocates warn some proposals miss the core problem. A bill introduced last December, the DRIVER Act, would assert that vehicle owners control data generated by their cars, but it would still permit automakers to continue collecting and selling information to third-party brokers. Advocates argue that access and deletion rights do not prevent excessive collection in the first place and that limits on gathering data are preferable to shifting the burden onto consumers to discover and remove what companies already hold.

There is also political noise around the issue: in July, then-Transportation Secretary Sean Duffy proposed a so-called "Freedom Car" policy that would protect the right to drive vehicles without mandatory automation or wireless transmission capability. Meanwhile, consumer appetite for simpler, less-connected vehicles appears to be growing, with interest in bare-bones concepts like the Slate Truck. Automakers, however, have powerful incentives to keep collecting data because it can be monetized, and many of them provide privacy pages where owners can submit requests to opt out, access, or delete collected information — even though the process can be complex for users.