Browse
Log in / Register
Share
On March 12, 2025, renewed scrutiny from state investigators and a wave of consumer lawsuits is forcing automakers to answer a blunt question: why do cars know so much about us, and where does that knowledge go? Modern vehicles track location, sync personal email accounts, and broadcast a permanent vehicle identification number, or VIN. That data is feeding everything from Big Tech cloud platforms to insurance scoring systems, often with driver consent buried in fine print.
Every new vehicle sold in the U.S. is equipped with sensors and modems that generate a rich record of each trip: GPS coordinates, acceleration, braking, turn-signal use, even driver fatigue warnings. Telematics boxes inside the car connect to manufacturer cloud platforms, which for most brands run on Amazon Web Services, Microsoft Azure, or Google Cloud. A single hour of driving can produce thousands of data points that are transmitted, recorded, and stored.
What makes that information commercially valuable is identity. When a driver creates an account for an app like FordPass, Hyundai Bluelink, or Tesla's app, they hand over an email address. The automaker then joins that email to a VIN through a server-side profile. Unlike a browser cookie, which can be cleared, a VIN is permanent. Once location history and email metadata are attached to it, the combination forms a durable digital ID that follows the car for its entire usable life.
Automakers rarely keep vehicle data to themselves. They license, share, and in some cases sell the data to technology companies and commercial data brokers. LexisNexis Risk Solutions, Verisk, and Arity—the data analytics arm of Allstate—have built large risk databases from driving data that is often described as "anonymized." That anonymization frequently means deleting names from account fields while keeping the VIN, which effectively pinpoints a specific household when cross-referenced with other datasets. Privacy researchers have repeatedly demonstrated that such de-identification is reversible.
The deals themselves are negotiated between corporate legal teams. Drivers are not party to these agreements. The connected services that collect the data are presented as optional "safety" or "convenience" features, with consent bundled into lengthy terms and conditions that require no separate click, no plain-language explanation, and often no obvious way to revoke sharing after enrollment.
Public awareness shifted sharply in March 2024, when The New York Times reported that General Motors had been sharing driver-behavior scores with LexisNexis Risk Solutions. GM's OnStar Smart Driver program was marketed as a feedback tool for safe-driving habits. But some drivers saw their auto insurance premiums rise after braking and acceleration data was handed to insurers. In some cases, consumers learned of the transfers only after reviewing insurer records or court files.
GM halted Smart Driver for 2022–2024 model years and announced it would require customer consent before sharing driving data with insurers. The fallout went beyond GM: class-action lawsuits against multiple automakers began citing each company's own privacy policies against it. By late 2024, several manufacturers had tightened their data-sharing language, even as telematics data continued to be monetized through pilot programs with insurance companies.
The issue is not limited to one automaker. An audit by the Mozilla Foundation, published in 2023, remains the most comprehensive independent look at the connected-car industry. Researchers reviewed 25 car brands and found that 84 percent of them share or sell personal data, and none met the group's minimum privacy standards. Every brand examined collected location and driving data; several acknowledged collecting photos, audio, text messages, and call history.
Automakers' standard response—"we anonymize data"—was rejected by Mozilla's analysts, who noted that VINs, trip patterns, and timestamps can be recombined to identify drivers. The report concluded that passenger vehicles are among the most invasive products the foundation has ever assessed, a finding that automakers have not effectively rebutted with technical evidence.
One of the least examined collection points is the car dealership itself. Test-driving vehicles may track driver behavior in "demo mode." Some sales and finance staff have been accused in federal filings of enrolling vehicles into connected services without explicit customer authorization to meet performance targets. Drivers who buy through the finance office often sign tablet screens while distracted, unknowingly activating features that share braking and location data with third parties.
Rental cars present the same problem. Rental companies' telematics programs can record speed and geolocation and tie those records to a renter's driver's license and payment card. That profile moves to the rental company's analytics partners, forming another pipeline through which driving data reaches commercial data pools without the driver ever seeing a data-processing agreement.
The significant shift of late is that state attorneys general are no longer waiting for a federal privacy law. Congress has debated but not passed comprehensive data-protection legislation, leaving states to act. In December 2024, Texas Attorney General Ken Paxton sued Allstate and Arity, accusing them of collecting location data from driving apps and telematics without proper consent. The complaint alleges Arity aggregated location data on more than 45 million Americans.
California, Colorado, and Vermont have also enacted or tightened data-broker registration laws, several of which specifically require disclosure of vehicle telematics data. The Federal Trade Commission, meanwhile, has taken the position in recent enforcement actions that precise geolocation is sensitive personal data even when direct identifiers are stripped—an argument that undermines the "anonymized driving data" defense in cases involving insurance scores and advertising profiles.
Until federal rules arrive, consumers have options, though none are perfect. The most effective step is to open the automaker's privacy portal or data-deletion page and revoke consent for any connected "driver insights" programs, such as OnStar Smart Driver, Hyundai Bluelink, or Ford Power-Up. For vehicles already enrolled, request a copy of the data report the manufacturer keeps on file.
California residents can exercise deletion rights under the CCPA, and several automakers voluntarily extend similar rights nationwide. Using a separate email alias for infotainment accounts prevents a VIN profile from being joined to a primary inbox. Finally, many connected features can be disabled from the infotainment screen after purchase without affecting essential safety systems, allowing owners to keep the car connected for navigation and emergency services while cutting off commercial data flows.
The privacy debate once centered on websites and phones, but vehicles are more revealing: they document our movements for weeks, expose our habits, and link our identities to a machine that cannot "forget." The U.S. privacy framework remains fragmented, but the era of automakers quietly monetizing driving data without meaningful accountability appears to be ending. For now, the safest approach is to treat the car the way you would treat a smartphone you cannot remove from someone else's cloud—and read every consent screen as if it were a contract, because for your data, it is.
