When you buy a new car today, you’re not just buying a vehicle. You’re signing up for something closer to a subscription tracking service, except you don’t get a discount for participating and no one asks for your permission.
Comparison with smart TVs is not difficult. Walmart released Vizio’s financial statements before buying the company constitutes the majority of the total profit not from the sale of physical televisions, but from the sale of viewership data and advertising.
Newer cars now run on a similar pattern and most drivers have no idea it’s happening. Like televisions, the hardware (ie, your car) is one thing, but your driving habits can be the real product.
What your car collects
“Privacy Nightmare on Wheels”
Today’s connected cars are packed with sensors, cameras, microphones, GPS systems and on-board computers. Many of these systems are dual: they keep the car in safe working order and serve the driver on the daily road, but they can also serve the manufacturer and its ultimate goals.
Your car can record where you go, when you go, how hard you brake, how fast you accelerate, and whether you’re driving day or night. Some systems go even further. The cameras track facial expressions to detect drowsy or distracted driving, warning when you look away from the road for too long. Constantly active microphones record sound inside the cabin. When you connect your smartphone, the car can retrieve your contact list, call history and text messages and link them back to your account with the manufacturer.
A Mozilla Foundation report titled *Privacy Not Includedfound that none of the 25 major automakers it assessed met basic standards for data transparency, user controls or security. The researchers found that 84% of these brands share or sell driver data, and 92% have little control over what is collected from drivers. The data your car generates isn’t just sitting on a server somewhere. It is packaged, sold and used in a way that most car buyers would never expect.
“Many people think of their car as a personal space — a place to call your doctor, have a private conversation with your child on the way to school, cry a breakup, or drive places you don’t want the world to know about,” said Jen Kaltrider. *Privacy Not Included report. “But that perception no longer matches the reality. All new cars today are privacy nightmares on wheels, collecting vast amounts of personal data.”
Where does your data go?
Many drivers are simply unaware
GM previously used OnStar Smart Driver every three seconds to monitor driver behavior, including hard braking, nighttime driving and speeding. This information was sold to consumer reporting agencies and passed on to insurance companies. Drivers only found out when premiums went up or coverage was denied.
As one consumer said In an FTC complaint After meeting with a GM customer service representative: “OnStar was able to track me when I signed up for this. They didn’t say anything about reporting it to a third party. Nothing. (…) You’re affecting our bottom line. I’m paying you, now you’re making me pay more to my insurance company.”
Federal Trade Commission Filed a complaint against GM and OnStar and ultimately finalized the settlement order. GM now faces a five-year ban on sharing geolocation and driver-behavior data with consumer reporting agencies and a 20-year consent order requiring express consent before collecting or sharing connected car data. Pursuant to California consumer privacy law, $12.75 million in the largest civil penalty ever under the California Consumer Privacy Act.
However, in context, GM reportedly made about $20 million over four years from selling data, meaning the fine is still less than what it made from selling drivers’ data in the first place. In addition, the FTC settlement carries no financial penalties at the federal level, a reminder to some that federal consumer protection in this space still lacks real teeth.
Nor is GM the only example. Attorney General of Texas Allstate and its subsidiary sued Arity For collecting and selling the driving data of more than 45 million people without consent.
Meanwhile, Connecticut’s attorney general In 2025, he issued dozens of violation notices with associated vehicle and location data listed as a special enforcement center under the state’s data privacy law. Likewise, Oregon has updated its privacy law Covering all automakers operating in the state, regardless of size, by September 2025, closing a loophole that allows smaller manufacturers to avoid compliance.
A non-exchange of value
New cars are more expensive than ever
When you stream content on a smart TV and the manufacturer sells your viewing data, you can at least claim that the hardware is cheaper because of it. You may not like the arrangement, but there is a useful trade-off.
There is no such trade with cars. The average new car transaction price today it’s $50,000 or so, the highest ever in the auto industry. I guess so the days of ultra-affordable cars passed, and even has a six-figure salary may not leave enough margin when considering the total cost of vehicle ownership.
You can too pay a monthly subscription for connected services which collects the data at the end. And then the car manufacturer profits from selling your data.
It is not so simple to refuse. For example, Tesla warns in its privacy notice stopping data collection “may result in reduced functionality, serious damage, or inoperability of your vehicle.” In fact, the features that make a car worth buying are the features that absorb your data.
What can you do?
GM car owners have some appeals
Options for protecting your data are limited, but they are available:
- Check the settings: Start with the privacy settings, which are usually buried in your car’s infotainment system or the manufacturer’s connected software. Look for data exchange links, telematics settings and anything related to insurance or third-party services. Turn off what you can.
- Check the policy: Please read the privacy policy before activating any linked features. It’s certainly tedious, but any data sharing disclosures are hidden in the fine print.
- Recall your data: If you own a GM vehicle and use OnStar Smart Driver, you can request a copy of your data or have it deleted through it. GM’s consumer privacy portal. The FTC order requires GM to make this option available to all US consumers.
Both a privacy and security issue
The auto industry has little control over data collection, although that is changing. The FTC pointed out that vehicle-generated data is now treated as sensitive consumer information rather than a byproduct of innovation. At the state level, enforcement is accelerating, with many states taking legal action.
But regulation moves more slowly than technology, and automakers still hold pools of accumulated data that no consent order can retroactively affect. Just like your TV knows what you’re watching, your car knows where you live, where you work, when you leave and how you get there. This data in the wrong hands is not just a privacy issue. This is security.
