The Dashboard Never Forgets: Inside the Quiet Business of Selling Your Driving Life

The average American spends roughly an hour a day behind the wheel, and for most of that time, the car is watching. Not with cameras pointed at the road, necessarily, but with sensors, modems, and software quietly logging a portrait of daily life: the route to work, the sudden stop at the intersection near the school, the late-night trip to a hospital parking lot.

For decades, a car was a dumb machine — private by default. The connected vehicle has inverted that assumption. Today's models, particularly those from the last five model years, are rolling data platforms, and the business built on their telemetry has grown faster than most owners realize.

What the Car Actually Records

The inventory is broader than most drivers would guess. Location history is the headline item: modern telematics systems can log GPS coordinates at regular intervals, effectively reconstructing a driver's week. Layered on top is behavioral data — hard-braking events, acceleration patterns, speed relative to posted limits, seatbelt use, even the time of day a vehicle is typically started.

Then there is the cabin itself. Many vehicles sold in the US include microphones for voice commands and, in some trim levels, interior cameras for driver-monitoring systems. Automakers differ on how much of this is recorded versus processed locally, but the disclosures are often ambiguous enough that even careful readers are left guessing.

A 2023 report by the Mozilla Foundation, which reviewed privacy policies from more than two dozen major brands, found that every single automaker it studied failed basic privacy benchmarks. Several policies explicitly contemplated sharing "demographic data" and in-cabin footage with third parties. No other product category Mozilla had examined — not smart speakers, not mental-health apps — performed worse.

From Telematics to Revenue

The monetization question is where things get uncomfortable. The clearest cautionary tale came to light in 2023 and 2024, when investigations by US journalists and subsequent litigation revealed that some automakers had shared detailed driving-behavior data with analytics firms, which in turn supplied scores to insurance-related clients. In the accounts that emerged from class-action lawsuits, drivers discovered that months of braking and speed data — collected without a meaningful moment of informed consent — had effectively been used to characterize their risk profile.

Automakers have since revised disclosures and, in some cases, ended those particular data-sharing arrangements. But the underlying economics have not disappeared. An executive at a major supplier once estimated a connected car could generate substantial recurring revenue over its lifetime; telemetry is one of the few assets a manufacturer owns that appreciates in value the longer the vehicle stays on the road.

There are legitimate uses, of course. Automatic crash notification, stolen-vehicle recovery, and over-the-air safety recalls all depend on connectivity. The problem is not that cars collect data — it is that collection is broad, consent is thin, and the consumer's leverage is nearly zero.

The Opt-Out Scavenger Hunt

Ask a room full of new-car owners whether they have reviewed their vehicle's privacy settings and most will ask what settings. That is the point. Disconnecting telematics on many popular models requires a phone call, a mailed form, or a buried menu in a companion app — and in some cases may disable safety features the owner actually wants.

Contrast this with the EU, where GDPR gives drivers a right to access and delete their data, forcing manufacturers to build real dashboards. In the US, protections remain a patchwork. California's Delete Act and the state's broader consumer-privacy regime offer the strongest tools, but a driver in Ohio or Georgia has largely only the terms of the purchase contract — written by the seller — between themselves and the data broker pipeline.

What a Fair Label Would Look Like

If nutrition labels transformed packaged food, a vehicle privacy label could do the same for cars. A meaningful version would state, in plain language:

• What is collected: location, driving behavior, cabin audio, cabin video — each listed separately, not lumped into "vehicle data."
• Where it goes: named categories of recipients, including insurers and analytics firms, with a yes-or-no on sale.
• How to stop it: a single, verifiable opt-out that does not degrade safety functions.
• How long it is kept: a retention period measured in something shorter than "as long as necessary."

Some movement is underway. The Federal Trade Commission has brought enforcement actions involving connected-device data practices, and a handful of automakers now publish summaries that approach readability. But voluntary summaries are not commitments, and the driver in the market for a new SUV this year is still, functionally, agreeing to a privacy policy they have never seen.

The car was once the last truly private room in American life — the place where people sang badly, thought out loud, and drove nowhere in particular. That room now reports its contents. Until labeling and law catch up, the honest default assumption for any connected vehicle is this: assume the dashboard remembers, and assume someone is willing to pay for the memory.