Your car is selling your data
Cars have become a major source of personal data collection, with automakers gathering information such as driving speed, night-time driving habits and location and often selling it to data brokers without customers realising. This came to light most prominently with General Motors, which was hit with an unprecedented five-year ban by the US Federal Trade Commission on selling customer data to consumer reporting agencies, after drivers who signed up to its OnStar Smart Driver feature found their information passed to brokers LexisNexis and Verisk, sometimes resulting in higher insurance premiums.
Research backs up the scale of the problem: a Mozilla Foundation study found every major car manufacturer it examined had "horrible privacy and security" practices, forcing customers to accept overlapping data policies covering the vehicle, connected services, smartphone apps and financing. Consumer Reports reached similar conclusions, finding nearly all automakers selling in the US collect and share "driver behaviour data". Unlike smartphones, cars spread data collection across multiple opaque systems, making it hard for owners to understand or control. A proposed US law, the DRIVER Act, would grant owners more access to their data but would still let automakers continue collecting and selling it, drawing criticism from privacy advocates who say it fails to limit excessive data collection at the source.
- Automakers routinely collect and sell driver data, often without clear consent
- GM banned for five years from selling data after FTC penalty
- Proposed US DRIVER Act criticised for not curbing data collection itself
New here? Start with this
Cars today are packed with internet-connected features, from navigation to roadside assistance apps, and these systems routinely collect details about how, when and where a vehicle is driven. Many manufacturers pass this information on to data brokers, sometimes without drivers fully understanding what they agreed to when they signed up for a connected service. General Motors became the most prominent example of this practice after regulators found it had shared customer driving data that, in some cases, led to higher insurance costs.
The issue sits at the intersection of the car industry, data broking firms, insurers and regulators such as the US Federal Trade Commission, which oversees how companies handle consumer information. Independent studies by groups including the Mozilla Foundation and Consumer Reports have found that most major car brands collect and share driver data, often through complicated, overlapping privacy policies covering the vehicle itself, connected apps and financing arrangements. This makes it difficult for owners to know what is being gathered or to opt out.
The issue matters because it affects millions of everyday drivers, many of whom may be unaware their driving habits are being monitored and monetised, sometimes with financial consequences such as changed insurance premiums. Lawmakers have begun responding, including a proposed measure in the US called the DRIVER Act, though its scope and effectiveness are themselves subjects of debate among privacy advocates and industry groups.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Those defending current industry practice and measures like the DRIVER Act argue that connected-car data collection underpins genuinely valuable features, from safety alerts and crash response to usage-based insurance discounts that reward careful drivers, and that consumers formally consent when they sign up for services such as OnStar Smart Driver. They contend that data monetisation helps fund the substantial cost of vehicle connectivity, that automakers are not uniquely culpable given how normalised data brokerage already is across the digital economy, and that giving owners greater visibility and access to their own data, as the DRIVER Act proposes, is a proportionate first step that preserves innovation and choice without imposing burdensome restrictions on a still-developing market.
The case against
Privacy advocates and critics argue that consent is largely illusory when it is buried in overlapping, hard-to-parse policies spanning the vehicle, app and financing agreement, so drivers cannot meaningfully understand or refuse what is being collected. They point to real harms already documented, including the FTC's action against General Motors and reports of driving data raising individuals' insurance premiums without their knowledge, as evidence that self-regulation has failed. For them, transparency measures like the DRIVER Act do not go far enough because they leave the underlying business of collecting and selling detailed behavioural data intact, and genuine protection requires limiting what can be gathered and sold in the first place, not merely granting owners after-the-fact access to it.
Americas Art Business Celebrity Culture Entertainment Markets World