The modern car is increasingly a rolling data device, and regulators are beginning to examine how much information automakers collect from drivers — and where that information goes after it leaves the vehicle.
FTC action puts automaker data practices under pressure
Earlier this year, the Federal Trade Commission took an unusually strong step against General Motors, imposing a five-year ban that prevents the company from selling customer data to consumer reporting agencies and third-party data brokers. The action followed concerns that GM had collected driving behavior information from customers and shared it in ways many drivers did not clearly understand.
The data at issue included details such as how often drivers exceeded speed limits and whether they drove at night. GM gathered this information through connected services tied to OnStar, including a Smart Driver feature that monitored driving behavior. Many customers had effectively agreed to the program during the connected-services enrollment process without realizing the scope of the data collection or sharing.
GM shared the information with LexisNexis and Verisk, two data brokers that work with the insurance industry. Some drivers later reported that their insurance costs rose after this type of information was used to generate risk profiles. Under the FTC settlement, GM must make it easier for customers to disable location tracking and allow them to access and delete data collected by the automaker.
Cars have become difficult privacy environments
The GM case has become a high-profile example, but it is not an isolated concern. A 2023 review by the Mozilla Foundation examined the privacy policies of major car companies and found widespread problems across the industry. The research highlighted how vehicle owners are often confronted with multiple overlapping policies covering the car itself, connected services, companion smartphone apps and even financing-related services.
That complexity makes cars different from many consumer electronics products. On a smartphone, privacy settings are usually concentrated in a familiar settings menu, even if they are not always simple. In a connected vehicle, data collection may involve embedded systems, cloud services, mobile apps, dealership enrollment flows and automaker account portals. Drivers may not know which system is collecting what, or whether switching off one feature actually stops broader data sharing.
Consumer Reports has also examined automaker data practices and found that many companies selling vehicles in the United States collect and share driver behavior data with other businesses. The result is a privacy landscape where vehicle owners can be tracked not only by their phones, but also by the car they drive every day.
Lawmakers are circling the issue, but privacy advocates want stricter limits
The policy response is still developing. Last December, three House Republicans introduced the Data Rights for Information and Vehicle Electronics in Real-time Act, known as the DRIVER Act. Supporters described the proposal as a way to reinforce the idea that vehicle owners should control the data produced by their own cars.
However, giving drivers access to their information is not the same as limiting how much information is collected in the first place. Privacy advocates have argued that a system built around access and deletion requests still places the burden on individual drivers. If an automaker can gather broad categories of data first, then require customers to search through privacy portals and request removal later, the default remains collection.
Another policy idea has emerged under the label “Freedom Car,” described by Transportation Secretary Sean Duffy as a right to drive vehicles that are disconnected and non-automated. The concept would block the government from requiring vehicles to include automated driving systems or wireless data-transmission capability. Whether that proposal or the DRIVER Act will become law remains uncertain.
A push for simpler, less-connected vehicles
The debate reflects a broader consumer frustration with cars that feel increasingly difficult to disconnect. Many drivers accept safety equipment such as backup cameras, but they may be less comfortable with behavior tracking, connected-service enrollment prompts, or in-vehicle screens that could become advertising platforms.
Interest in more basic vehicles has grown as consumers question whether every new car needs extensive connectivity, sensors and cloud services. Concepts such as the Slate Truck have drawn attention partly because they appear to tap into demand for simpler transportation. Still, the market incentives point in the opposite direction: automakers can generate value from data collection, partnerships and connected services, giving them little reason to scale back voluntarily.
The problem extends beyond automakers. Roadside surveillance systems and other connected infrastructure can add more layers of tracking to daily driving. For consumers, the issue is not just whether a vehicle has an app or a data plan, but whether mobility itself is becoming harder to separate from data collection.
What drivers can do right now
Vehicle owners who want to limit data sharing usually need to start with the automaker’s privacy portal. Most major car companies provide a way to submit privacy requests, including opt-out requests where available, though those pages can be difficult to find and may be written in dense legal language.
Connected-car smartphone apps are another important place to check. Privacy controls inside those apps are often easier to locate than automaker web forms, and they may include settings related to location, diagnostics, driving behavior or personalized services. Drivers should also review any connected-services enrollment they accepted when buying or leasing a vehicle, especially if features were activated at the dealership.
The available controls vary widely by automaker, and turning off one feature may not disable every form of data collection. Still, checking account settings, app permissions and privacy request pages is a practical first step for anyone concerned about how their vehicle data is being used.
Connected cars have made driving more software-driven, but the privacy rules have not kept pace. The FTC’s action against GM shows that regulators are paying attention, yet the bigger question remains unresolved: whether drivers should merely manage the data their cars collect, or whether automakers should collect far less of it by default.
