Is Your Car Spying on You? What Automakers Actually Collect — and How to Stop It

Your car knows where you slept last night. It knows how hard you hit the brakes on your way to work, whether you buckled your seatbelt, how fast you took that on-ramp, and—if it has the right sensors—what you said out loud with the windows up. Modern vehicles have quietly become some of the most sophisticated data-collection devices most of us own, and for years almost no one was paying attention.

That changed when researchers, U.S. senators, and regulators started reading the fine print. What they found is not a conspiracy theory. It is documented in privacy policies, Senate letters, Federal Trade Commission orders, and a record-setting settlement with one of America’s largest automakers. Here is what your car actually collects, where that information goes, and—most importantly—what you can do about it.

“The worst product category we have ever reviewed for privacy”

In September 2023, the Mozilla Foundation—the nonprofit behind the Firefox browser—published a study of 25 car brands as part of its long-running *Privacy Not Included buyer’s guide. The verdict was blunt: every single brand failed. Mozilla called cars “the official worst category of products for privacy that we have ever reviewed.”

The researchers spent more than 600 hours reading privacy policies—roughly three times longer than they spend on a typical product category—and still could not fully map where all the data goes. Their headline findings, drawn directly from the automakers’ own policies:

• All 25 brands collect more personal data than they need to operate the vehicle.
• 84% say they can share or sell your personal data to service providers, data brokers, and other businesses. Nineteen of the 25 brands (76%) specifically reserve the right to sell it.
• 56% say they will share your information with the government or law enforcement in response to an informal request—not necessarily a warrant or court order.
• Only two brands, Renault and Dacia (both sold in Europe, where the GDPR privacy law applies), told drivers they have the right to have their data deleted.

The categories of data some policies claim the right to collect are startling. According to Mozilla’s review, Nissan’s policy listed “sexual activity,” Kia’s mentioned “sex life,” and six brands referenced collecting “genetic information.” Whether or not any manufacturer actively gathers something that extreme, the policies were written broadly enough to permit it.

What a connected car actually knows

A modern vehicle collects data from several overlapping sources at once: the car’s built-in sensors and cameras, the connected services you subscribe to (like OnStar, FordPass, or Toyota Connected), the companion smartphone app—which can also reach into contacts and location data on your phone—and third-party integrations such as satellite radio or navigation.

Put together, that can include precise geolocation (everywhere you drive and when), driving behavior such as speed, acceleration, and hard braking, seatbelt use, phone contacts synced through the infotainment system, voice commands, and diagnostic data about the vehicle itself. Precise location data is especially sensitive because, as California prosecutors put it, knowing where a car goes reveals “an enormous amount of personal, sensitive information about that person—their home, work, children’s school, place of worship.”

Where the data goes: brokers and insurers

The most concrete evidence of what happens next came from General Motors. In April 2024, The New York Times reported that automakers, including GM, were sharing customers’ driving behavior with insurance companies—and that some drivers saw their premiums rise as a result. Many had unknowingly been enrolled through a feature called OnStar Smart Driver, which rated their driving.

Regulators dug in, and the details that emerged were striking. According to the California Attorney General, between 2020 and 2024 GM sold the names, contact information, geolocation, and driving-behavior data of hundreds of thousands of California drivers to two data brokers, Verisk Analytics and LexisNexis Risk Solutions. Those brokers intended to build a “driver-rating product” to sell to auto insurers for setting rates. Nationwide, GM reportedly made roughly $20 million from these sales.

GM was not alone. A U.S. Senate investigation led by Senators Ron Wyden and Edward Markey found that Hyundai had provided data from 1.7 million cars to Verisk, which paid the automaker $1,043,315.69—about 61 cents per car.

Your car and law enforcement

Location data also flows to the government, and here the industry made promises it did not keep. In an April 2024 letter to the FTC, Wyden and Markey revealed that only five automakers—GM, Ford, Honda, Stellantis, and Tesla—require a warrant before turning over location data to law enforcement. And only Tesla told car owners when the government requested their data.

By contrast, Toyota, Nissan, Subaru, Volkswagen, BMW, Mazda, Mercedes-Benz, and Kia all confirmed they would hand over location data in response to a subpoena, which does not require a judge’s approval. The senators noted this directly contradicted a voluntary pledge the industry had signed years earlier, committing to demand a warrant or court order except in emergencies. As the senators pointed out, vehicle location data can expose intensely private choices—where someone seeks medical care, attends a protest, or visits a place of worship.

The regulatory reckoning

The GM case became a landmark. In January 2025 the FTC announced a complaint, and on January 14, 2026 it finalized an order against GM and OnStar for collecting and selling geolocation and driving-behavior data “without adequately notifying consumers and obtaining their affirmative consent.” The order bans GM from sharing that data with consumer reporting agencies for five years and, for 20 years, requires the company to get clear opt-in consent before collecting connected-vehicle data. It also forces GM to let U.S. drivers request, delete, and limit collection of their own data.

Then, on May 8, 2026, California Attorney General Rob Bonta announced a $12.75 million settlement with GM—the largest penalty under the California Consumer Privacy Act to date. The state found that GM failed to notify drivers of the sales and misled them, having stated in its own privacy policy that it did not sell driving or location data. Under the settlement, GM must stop selling driving data to consumer reporting agencies for five years, delete retained driving data within 180 days absent express consent, and ask Verisk and LexisNexis to delete the data too.

Notably, California regulators concluded that California drivers themselves were not charged higher premiums—because state insurance law bars insurers from using driving data to set rates. Drivers in other states had no such protection. Where you live shapes how exposed you are.

How to find out what your car collects—and limit it

You have more control than you might think, though the amount varies by brand and state. A practical starting point:

Look up your specific vehicle. A free tool called the Vehicle Privacy Report, from the company Privacy4Cars, lets you enter your VIN and see which categories of data your model is configured to collect and who it may be shared with. Consumer Reports and the Electronic Frontier Foundation also publish plain-English walkthroughs.

Turn off driver-scoring programs. Features with names like Smart Driver, Driver Feedback, or Driving Score are the ones most often tied to insurance data sharing. Disabling them in your connected-services app is one of the highest-impact steps you can take.

Review the app and infotainment settings. In your car’s companion app (OnStar, FordPass, HondaLink, Toyota Connected, Blue Link, and the like), look for “Data Privacy” or “Data Usage” and opt out of sharing with third parties and of behavioral advertising where the option exists.

Use your legal right to opt out. If you live in California or another state with a comprehensive privacy law, you can formally demand that a company stop selling your data and delete what it holds. California’s new Delete Request and Opt-out Platform (DROP) lets residents send a single deletion request to more than 575 registered data brokers at once.

Understand the trade-offs. Opting out is not always free of consequences. Fully disabling connectivity can cost you conveniences—and sometimes safety features—like automatic crash notification, stolen-vehicle recovery, remote start, and over-the-air software updates. The right balance is a personal call, but you cannot make it well without knowing what is being collected in the first place.

The bottom line

The “computer on wheels” that automakers spent a decade bragging about turned out to be a two-way mirror. The good news is that the era of quiet, consent-free data harvesting is finally facing real consequences—from a record California penalty to a 20-year federal order. The better news is that you do not have to wait for regulators to catch up brand by brand. A few minutes with your VIN, your car’s app settings, and your state’s privacy tools can meaningfully shrink the trail your vehicle leaves behind.

Sources

• Mozilla Foundation, “It’s Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy” (Sept. 6, 2023)
• U.S. Senator Ron Wyden, “Wyden, Markey Reveal Automakers Provide Detailed Location Information to Law Enforcement Without a Warrant” (April 30, 2024)
• U.S. Senator Ron Wyden, “Wyden Investigation Reveals New Details About Automakers’ Sharing of Driver Information with Data Brokers” (July 26, 2024)
• Federal Trade Commission, “FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers’ Informed Consent” (Jan. 2026)
• California Office of the Attorney General, “Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement” (May 8, 2026)
• Consumer Reports, “Your Car May Be Spying On You. Here’s How to Get It to Stop.”
• Electronic Frontier Foundation, “How to Figure Out What Your Car Knows About You (and Opt Out of Sharing When You Can)”