Connected Cars Threaten Privacy: Experts Demand US Data Security Laws

Update: April 1, 2025

America’s new cars are becoming rolling data centers, but the legal framework protecting what they collect remains stuck in the dial-up era. A growing chorus of privacy experts and consumer advocates is warning that without urgent federal action, US drivers will lose control over their personal information — and face real security risks.

Today, the Australian Electric Vehicle Association (AEVA) released a report detailing how 95 percent of new vehicles sold globally by 2035 will be connected. While the AEVA focuses on Australia, its findings hold a mirror to the United States, where similar gaps exist. The group calls on governments worldwide to mandate strict data privacy laws, including local data storage, opt-in defaults, and functional isolation of safety systems.

“Policymakers have the power to make effective changes to protect drivers and consumer choice,” said James Pickering, National President of AEVA. “Instead of instigating fear and distrust in the connected vehicles we drive, they can act now.”

Why US Drivers Should Care

Modern cars collect everything from location history and driving habits to biometric data and even in-cabin audio. This data is often transmitted to automakers and third parties, sometimes stored abroad, and can be accessed by law enforcement or hackers. The US Privacy Act of 1974 does not cover the private sector, and the 1999 Gramm-Leach-Bliley Act offers only limited protections for financial data. The patchwork of state laws like California’s CCPA helps, but leaves gaps in other states.

A 2024 report by the Government Accountability Office (GAO) found that automakers collect an average of 25 distinct data points per vehicle per trip, yet fewer than half of consumers were aware of the breadth of collection. “We have a system where the data is flowing, but the rules are not,” said a GAO official.

Real-World Consequences

The danger is not theoretical. In 2023, hackers exploited a vulnerability in a major automaker’s telematics system, gaining remote access to steering and brakes of multiple vehicle models. The recall affected over 1.4 million vehicles in the US. That incident, combined with rising cases of ransomware targeting dealership management systems, has pushed the issue to the forefront.

“The only features that should be always on are crash notification, emergency SOS, and essential safety systems,” noted John Pappas, a former executive at Toyota Australia, in earlier comments to CarsGuide. “All telemetry and driver recordings should be encrypted and not transmitted unless the driver explicitly opts in.”

What Needs to Change

Consumer advocacy groups like the Electronic Frontier Foundation (EFF) and the Center for Auto Safety are now urging Congress to adopt a comprehensive federal framework. Key demands include:

• Data storage on US soil: To prevent foreign governments from accessing American drivers’ data without due process, all sensitive telematics data should be stored on servers within the United States.
• Opt-in default for non-essential data: Features like infotainment personalization, surveillance-based insurance scoring, and marketing analytics should be turned off by default. Drivers must explicitly consent before any data leaves the vehicle.
• Safety isolation: Automakers must architect vehicles so that critical functions (braking, steering, acceleration) are physically separate from multimedia and internet-connected systems, preventing remote hijack.
• Align with European standards: The EU’s GDPR and the upcoming Data Act set clear rules for vehicle data sharing. The US should adopt similar principles to ensure continuity for global automakers and better protections for consumers.

Industry Response

The Alliance for Automotive Innovation, which represents major automakers including Ford, General Motors, and Stellantis, has pushed back against mandatory storage requirements, citing cost and complexity. In a statement, the group said it supports “voluntary best practices” and argues that many OEMs already encrypt data and follow strict security protocols.

However, independent cybersecurity researcher Dr. Nina Kessler argues that voluntary standards are insufficient. “Without a legal mandate, there’s no penalty for cutting corners,” she told TechCrunch. “We saw the same pattern with early IoT devices — and now we have botnets of hacked smart cameras.”

The Path Forward

Senator Edward Markey (D-MA) has reintroduced the “SPY Car Act” (Security and Privacy in Your Car Act), which would require automakers to label their data collection practices and implement basic security safeguards. The bill has stalled in previous sessions but gained renewed attention after a series of high-profile hacks.

On the state level, California and Texas have proposed bills requiring automakers to provide owners with a “data dashboard” that allows them to see and delete collected data. Yet without a federal floor, companies may simply comply with the strictest state, leaving drivers elsewhere exposed.

“Every driver should have the same rights no matter which state they live in,” said Justin Brookman, director of consumer privacy at Consumer Reports. “It’s time for Congress to catch up to the technology in our driveways.”

What You Can Do Now

While the law lags, consumers can take steps to protect themselves:

1. Read the privacy notice — Automakers are required to provide it. Look for language about data sharing with third parties and storage locations.
2. Disable unnecessary features — Turn off Wi-Fi hotspots, cloud-based voice assistants, and any optional data sharing. In many models, you can do this through the car’s settings menu.
3. Ask your dealer — Pappas advised buyers to ask directly: “Where is my data stored? Who has access to it? Can I delete it?”
4. Use a privacy-focused telematics device — If you need insurance monitoring, choose a provider that stores