Your connected car is a rolling data collector. Its built-in cellular modem streams your location, braking patterns, speed, and often your paired-phone contents back to the manufacturer, and from there the information can move to data brokers, insurers, and law enforcement. Connected vehicle data privacy in the United States is governed by a patchwork of state laws and one recent federal enforcement action rather than any single comprehensive statute, so what you can actually control depends heavily on where you live and which automaker built your car.
What Your Car Is Collecting
Telematics systems pull data from sensors, onboard computers, and the vehicle’s cellular link. Four broad categories account for most of it.
Location and movement data includes GPS coordinates, timestamps, direction, speed, and route history. These systems often store frequent destinations, effectively mapping where you live, work, and spend your evenings, with enough granularity to reconstruct your movements over months or years.
Driving behavior data covers acceleration, hard braking, sharp turns, speeding, and time-of-day patterns. In the January 2025 case against General Motors, the FTC found that “every instance of hard braking, late night driving, and speeding” was recorded and later sold.1Federal Trade Commission. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data
Vehicle health data includes diagnostic codes, tire pressure, battery voltage, fuel consumption, and oil life. Manufacturers use it to plan recalls and refine future designs.
Infotainment and personal data can be the most surprising category. When you pair your phone, the vehicle may copy your contact list, call logs, and text metadata. Newer models with cabin cameras and microphones track eye movement and facial expressions for fatigue monitoring, generating biometric data most drivers never realize they are producing.
Who Receives the Data
Manufacturers are the primary recipient. They use telematics to develop safety recalls, refine designs, deliver over-the-air software updates, and maintain a relationship with the vehicle for its entire lifespan. The data rarely stays with them.
Data brokers buy or receive vehicle information to build consumer profiles. The GM case revealed a specific pipeline: GM collected driving behavior through its Smart Driver feature and shared it with consumer reporting agencies, which then sold reports to insurers. One consumer told GM customer service, “When I signed up for this, it was so OnStar could track me. They said nothing about reporting it to a third party.”1Federal Trade Commission. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data
Fleet management companies also consume telematics from commercial vehicles to track idle time, fuel efficiency, and driver safety compliance.
How Vehicle Data Affects Your Insurance
Insurers reach telematics data through two doors. The first is voluntary usage-based insurance. You agree to share driving data in exchange for a possible discount, and the program tracks miles, time of day, location, rapid acceleration, hard braking, hard cornering, and even airbag deployment.2National Association of Insurance Commissioners. Understanding Usage-Based Insurance Premiums can drop, but they can also rise, and drivers often disagree with which behaviors the insurer chose to penalize.
The second door is the one that caught most people off guard. As the GM case demonstrated, manufacturers can hand your driving data to consumer reporting agencies without making the connection obvious. Those agencies sell reports to insurers. You could have never signed up for a usage-based program and still see your rates move because of data your car collected.
Under the proposed FTC order, GM and OnStar are banned for five years from disclosing geolocation and driver behavior data to consumer reporting agencies, and they must obtain affirmative consent before collecting connected vehicle data going forward.1Federal Trade Commission. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data That order binds only GM. Other manufacturers have not faced comparable restrictions.
Law Enforcement Access
A connected vehicle produces the kind of detailed location history police find valuable, and the legal ground here is still shifting. The automobile exception to the Fourth Amendment allows warrantless vehicle searches on probable cause, and courts have applied it to digital data stored in vehicle systems, meaning a traffic stop can expose navigation history, call logs, and paired-phone data.
For longer-term surveillance, Carpenter v. United States offers some protection. The Supreme Court held in 2018 that obtaining seven days of historical cell-site location information is a search requiring a warrant, reasoning that such tracking “partakes of many of the qualities of GPS monitoring” and gives the government “near perfect surveillance.” Five justices specifically noted that similar concerns would arise from activating a stolen-vehicle detection system to track a person.3Supreme Court of the United States. Carpenter v. United States, No. 16-402 Courts are still working out how far Carpenter reaches into telematics data.
Geofence warrants add another route. Law enforcement can request data on every device present in a defined area during a defined window, sweeping in connected vehicles alongside phones. Legal standards vary by jurisdiction, and some states have started restricting these warrants or requiring extra judicial oversight.
What Federal Law Actually Covers
No single federal statute governs the telematics data your vehicle generates. The pieces that exist are narrower than their names suggest.
The Driver’s Privacy Protection Act, 18 U.S.C. §§ 2721–2725, is often cited as a vehicle privacy law, but it prohibits only state motor vehicle departments from disclosing personal information tied to DMV records without consent.4Office of the Law Revision Counsel. 18 USC 2721 – Prohibition on Release and Use of Certain Personal Information from State Motor Vehicle Records If an automaker sells your braking patterns to an insurance company, the DPPA has nothing to say about it.
The FTC has broader authority under Section 5 of the FTC Act, which bars unfair or deceptive practices in commerce.5Federal Trade Commission. A Brief Overview of the Federal Trade Commission’s Investigative, Law Enforcement, and Rulemaking Authority The GM action is the first time the agency used that authority against an automaker for connected vehicle data.6Federal Trade Commission. Privacy and Security Enforcement Violations of an FTC order can carry civil penalties up to $51,744 per violation.1Federal Trade Commission. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data But FTC enforcement is reactive. The agency acts after harm has occurred and cannot write comprehensive privacy rules for the auto industry on its own.
Your Rights Under State Privacy Laws
State law is where practical control over vehicle data actually lives.
California
The California Consumer Privacy Act gives residents the right to know what personal data a business collects, the right to request deletion, and the right to opt out of data sales. Deletion requests must be answered within 45 calendar days, extendable by another 45 days with notice. Opt-out-of-sale requests carry a tighter deadline of 15 business days.7State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
The California Privacy Rights Act added a “sensitive personal information” category that includes precise geolocation. You can direct a business to limit its use of that data to only what is needed to provide the services you requested, and businesses must post a “Limit the Use of My Sensitive Personal Information” link on their homepage.8CPRA Resource Center. Text of the California Privacy Rights Act Because vehicle GPS coordinates qualify as precise geolocation data, California residents have real leverage over how automakers handle their location history.9California Privacy Protection Agency. What Is Personal Information
Virginia and Beyond
Virginia’s Consumer Data Protection Act gives consumers the right to access, correct, delete, and obtain copies of their personal data, and to opt out of data sales, targeted advertising, and profiling. Virginia also treats precise geolocation as sensitive data requiring consent before processing.10Virginia Code Commission. Virginia Code Title 59.1 Chapter 53 – Consumer Data Protection Act
Roughly 20 states now have comprehensive consumer privacy laws, including Texas, Colorado, Connecticut, Oregon, Indiana, and Kentucky, with several taking effect in 2025 and 2026. The details vary, but core rights to access, delete, and opt out of sales appear in nearly all of them. Even outside those states, some manufacturers extend California and Virginia rights to all U.S. customers.
How to Submit an Opt-Out or Deletion Request
Start with your Vehicle Identification Number, the 17-character code on the driver’s-side dashboard or the door jamb sticker. Manufacturers use the VIN to link your identity to the vehicle’s data profile, and every request will ask for it.
Find the manufacturer’s privacy portal on their corporate site. These are typically labeled “Consumer Privacy Request” or “Your Privacy Choices” and are usually linked in the footer. Read the privacy policy before submitting anything. It will list the specific categories of data collected (telematics, geolocation, biometric, infotainment) and which third parties receive them. Naming the categories you want deleted or opted out of produces better results than a blanket request.
You will likely need proof of ownership: vehicle registration, a photo of the VIN plate, or a valid driver’s license. Have those ready. Most portals send a verification email with a confirmation link after you submit. Complete that step quickly, because some manufacturers discard unverified requests after a short window.
Under the CCPA, deletion requests must be fulfilled within 45 calendar days (extendable to 90 with notice), and opt-out-of-sale requests within 15 business days.7State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) Save the confirmation email once the request is complete. That record is your evidence that the manufacturer acknowledged your choice.
What You Give Up by Opting Out
The trade-off is real. Opting out of data sharing or disabling telematics collection can mean losing roadside assistance, automatic crash detection, remote door locking, and remote engine start through the phone app. Many manufacturers tie their most useful connected services to the same data pipeline that feeds analytics and third-party partnerships, and separating them is not always possible from the consumer side.
Some drivers physically disconnect the cellular telematics modem to cut the vehicle off from external servers entirely. That can have side effects: in some models, disconnecting the modem disables front speakers, the hands-free microphone, or other systems routed through the telematics unit. Warranty implications are uncertain. Consult the owner’s manual before taking this step, and know which features depend on the modem.
The GM order may push the industry toward more granular controls, letting consumers switch off specific data flows without losing all connected services.1Federal Trade Commission. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data Whether other automakers follow voluntarily is an open question.
Wiping Your Data Before Selling or Trading In
When you sell or trade in a connected vehicle, your data does not leave with you. Navigation history, paired-phone contacts, call logs, saved Wi-Fi passwords, garage door codes, and streaming logins can all persist in the infotainment system for the next owner.
The FTC recommends taking these steps before transferring ownership:11Federal Trade Commission. Selling Your Car? Clear Your Personal Data First
- Factory reset the infotainment system through the vehicle’s built-in option. The exact menu path varies; check the owner’s manual.
- Cancel or transfer subscription services like satellite radio, mobile Wi-Fi, and any data services tied to your account.
- Remove the vehicle from your manufacturer app. Otherwise, you may keep receiving the new owner’s location data, or they may reach your account.
- Delete your driver profile, not just the paired phone. Many newer vehicles store individual profiles containing seat positions, navigation preferences, and paired device histories.
Manufacturer-specific steps matter. Toyota vehicles from 2022 onward require you to both reset the multimedia system and remove the vehicle from the Toyota app to sever the previous owner’s primary profile. If the previous owner skips those steps, the new owner can replace the primary driver profile through the vehicle’s setup menu, but that cancels any active trials or subscriptions and sends a notification to the previous owner.12Toyota. Toyota Audio Multimedia Change of Ownership Guide
If you are buying a used connected vehicle, check whether the previous owner’s data is still present. Look for saved addresses in the navigation system, paired Bluetooth devices, and logged-in streaming accounts. If someone else’s data is still there, perform the factory reset yourself before entering your own. The few minutes it takes can stop the previous owner from keeping remote access to your location or door locks.