Four Wheels, One Data Trail: The Privacy Reckoning Hiding in Your Driveway

The average new vehicle sold in the United States now ships with more computing power than the machines that guided the Apollo missions, and it spends its idle hours doing something Apollo never had to worry about: transmitting. Telematics modules in contemporary cars stream location history, braking and acceleration patterns, seatbelt status, and in some models cabin camera and microphone data back to manufacturers — often continuously, often by default.

Most drivers have a vague sense that their car is 'connected.' Far fewer understand what that connectivity costs.

From Repair Tooling to Revenue Stream

Telematics began, innocently enough, as a diagnostics and safety feature: automatic crash notification, roadside assistance, over-the-air software updates. But the same pipes that deliver emergency services after a collision can carry a remarkably granular portrait of a driver's life. Where you sleep. Which places of worship or medical clinics appear in your location history. Whether your driving patterns suggest a long commute, a night shift, or a second address.

That portrait has commercial value — most acutely to the insurance industry. Investigations and reporting over the past several years revealed arrangements in which automaker-affiliated data flows reached analytics firms and, from there, insurance scoring products, sometimes involving drivers who had no meaningful awareness that their braking habits could inform a premium. The revelations prompted congressional inquiries and a wave of class-action litigation that continues to work through the courts.

Law enforcement interest followed naturally. Vehicle telemetry has already been used in criminal prosecutions, and manufacturers field legal-process requests for location and event data with little public visibility into how often they comply.

Washington Starts Paying Attention

The Federal Trade Commission has begun treating the connected car as a privacy enforcement surface rather than a regulatory blind spot. In 2023, the agency took the unusual step of proposing a new safeguard specifically barring auto dealers from selling or sharing certain vehicle data without affirmative consent. Enforcement actions and consent decrees elsewhere in the privacy space — including cases penalizing companies for retaining sensitive location data indefinitely — signal that vehicle data is squarely within the FTC's view of 'sensitive' information.

State law is moving too. California and a handful of others now treat biometric and precise-geolocation data with heightened protections, and several legislatures have floated bills specifically addressing automotive data-sharing practices.

What Owners Can Actually Do

Complete opt-out remains frustratingly difficult — the settings are scattered across the infotainment system, the companion smartphone app, and the manufacturer's web portal — but meaningful steps exist:

• Locate the data-privacy settings in your vehicle and its app. Most manufacturers now publish a privacy 'settings' or 'preferences' section where telematics sharing can be limited or disabled.
• Request your data and its deletion. Under applicable state laws and manufacturers' own privacy policies, owners can ask what has been collected and, in many cases, request deletion — though safety-related records may be retained.
• Revoke third-party connections. Companion apps, EV-charging services, and insurance 'reward' programs are common sharing pathways worth auditing.
• Read the fine print before enrolling in usage-based insurance. Discount programs built on driving scores are voluntary telematics collection by design.

The Problem That Outlives the Purchase

There's a wrinkle most coverage misses: the used-car market. A vehicle's data relationship doesn't necessarily end when the title changes hands. Prior owners' profiles can linger in manufacturer accounts and dealer-linked services, while buyers of secondhand connected cars may inherit stale settings, active subscriptions, and even a previous owner's paired devices and remote-access credentials.

Both sides of a used transaction have homework. Sellers should unpair accounts, deregister the vehicle from manufacturer apps, and request data deletion before handing over keys. Buyers should perform a factory-level reset, re-register the vehicle under their own account, and confirm no lingering remote-access authorizations remain.

A car has always been one of the most expensive purchases an American household makes. What's changed is that it's now also one of the most prolific data collectors you own — and unlike your phone, you can't leave it at home.