Browse
Log in / Register
Share
A new study released Friday shows that modern cars are quietly generating a detailed profile of your driving, shopping, and even health patterns, and then sending that profile to advertisers and data brokers with little or no consent. Automakers have long insisted they only collect data needed to improve safety, but the findings point to a broader commercial ecosystem.
The report, published on May 9, 2026, was put together by a coalition of privacy researchers from three consumer watchdog groups. They spent six months monitoring 25 of the best-selling connected-car models on the U.S. market. Using network-analysis tools, they recorded every time a vehicle sent data to outside servers. They also reviewed the privacy policies and terms of service that come with each car, alongside the infotainment settings owners are shown.
The result was alarming: 23 out of 25 models transmitted identifying information to at least one third-party company that had nothing to do with operating the car. Only two vehicles let owners completely switch off data flows without disabling safety functions. The researchers said the auto industry as a whole treats driver information as a revenue stream rather than something to protect.
The data leaving your car is far more intimate than most people realize. It isn't just GPS coordinates. The study found cars sending speed, acceleration, braking patterns, seat-belt status, and even road conditions like potholes and weather. In-car voice assistants recorded snippets of conversation, and in one model, the vehicle transmitted the driver's entire contact list to a third-party analytics server every hour.
Some vehicles also sent a unique device ID that can be linked to an owner's smartphone, home Wi-Fi network, or even a work badge. That means a trip history can be matched to a named person, not just a car. The researchers described this as a "digital fingerprint" that follows drivers everywhere.
The report breaks down the recipients into three main groups. The first is advertisers. Two manufactures were found sending driver location and infotainment preferences to major digital advertising platforms. This lets those platforms connect a person's real-world journeys to their online search and shopping profiles, enabling hyper-targeted ads.
The second group is auto insurance telematics companies. Several automakers share driving-behavior scores with firms that help insurers set premium rates. Even if you never signed up for usage-based insurance, your braking habits and nighttime driving activity can be scored and sold.
The third group is commercial data brokers. The researchers found contracts between automakers and two large data aggregation firms covering trip histories, frequently visited locations, and inferred personal categories like "commuter," "night driver," or "family with children." These profiles are often resold into the consumer data economy, ending up in services used by lenders, landlords, and retailers.
Automakers' response to the study follows a familiar script. A trade association argued that "vehicle data is only shared with explicit consent or for legally permitted safety purposes." But the researchers say the consent language is buried in a 50-page digital document that users scroll past on a small touchscreen during vehicle delivery. Even clearly written opt-out settings rarely stop all data flows.
The study found that disabling the "data sharing" toggle in several vehicles did not prevent the car from sending basic telemetry and device identifiers. One OEM continued collecting driver location data even when the driver explicitly declined a feature that seemed to rely on it. The report calls this a "consent illusion," because owners believe they've made a choice when they actually haven't.
Location data has already caused concrete harm. In recent court cases, plaintiffs have shown that someone used car-tracking data to follow an ex-spouse and learn where their children attended school. Insurers have used car data to double a driver's rates after aggressive acceleration patterns were logged, even though the driver had no tickets and no crashes. Employers who provide fleet vehicles have received access to detailed employee whereabouts during off-duty hours.
Security is another issue. Every new data-sharing receiver adds a potential entry point for hackers. Last year, independent security researchers demonstrated that a flaw in a phone-app feature could let a remote attacker control braking and steering in a popular EV. Automakers patched that issue, but the basic architecture remains: your car is continuously communicating with many servers you've never heard of.
The timing of the report is no accident. The Federal Trade Commission has been warning the auto industry about unfair data collection since an earlier staff report. California's Privacy Protection Agency recently launched a rulemaking process specifically for connected vehicles. And on the day the study was released, a bipartisan group of U.S. senators reintroduced legislation called the "Protecting Driver Privacy Act."
That bill would require automakers to obtain separate, unambiguous consent before collecting driving-related data, and it would prohibit selling that data to brokers entirely. It would also give drivers the right to delete their vehicle history. Privacy advocates praised the proposal but said the auto lobby will likely try to water it down.
You shouldn't wait for lawmakers. Start by diving into your car's settings menu — usually under "Privacy," "Data Collection," or "Connectivity Services." Turn off everything that isn't strictly necessary for safety. If you use Apple CarPlay or Android Auto, grant as little access to your contacts and calendar as possible; your phone is already giving those apps plenty.
Next, check your owner's manual for a way to disable the embedded telematics unit. Some dealerships can do this on request, though many will claim it voids certain features. You can also pull a fuse for the infotainment system in some older models, but that may disable crash-related emergency call features. Read the manual carefully.
Finally, use your phone for navigation rather than the built-in GPS. Built-in maps often run in the background and send position data even when you're not using them. Phone navigation gives you more direct control over which apps see your location, and you can revoke permissions whenever you want.
The takeaway from this study is straightforward: your car is a connected computer that watches you and talks about you. The data it collects is valuable to others, which is why automakers are so resistant to turning it off. Until laws force the industry to treat consent as a real choice, no toggle or privacy policy will protect you.
The researchers phrase it bluntly: "This isn't a bug. It's a business model." Car manufacturers have become data companies, and every drive is a data harvest. Fortunately, public pressure and new legislation are starting to shift the debate. But until the rulebook catches up, you need to treat your own car like a device that may be sharing your secrets with strangers.
