Your car files a report on you.
Researchers who review products for privacy called cars the worst category they had ever examined. Then one automaker got caught selling driving behavior to insurers. This is what the vehicle in your driveway collects, and where it goes.
The worst category ever reviewed
In 2023, Mozilla's Privacy Not Included team reviewed 25 car brands and gave a failing privacy label to all 25, calling cars the worst product category the project had ever examined. Every brand collected more personal data than the vehicle needed to operate, and most said in their own policies that they could share or sell it. The researchers spent hundreds of hours on the review and still could not confirm basic facts, like whether any brand encrypted all the personal data it held.
A modern car is a phone with wheels: cameras, microphones, GPS, an internet connection, and an app tied to your identity. The data flows to the manufacturer by default.
The GM case
What that flow looks like in practice became public in 2024, when New York Times reporting revealed that General Motors had been collecting detailed driving behavior through its OnStar Smart Driver feature and supplying it to the data brokers LexisNexis and Verisk. The brokers packaged trips and hard braking into risk files, rapid acceleration and late-night driving included, and insurers used the files to price premiums. Drivers reported sharp and unexplained rate increases, and many said they never knowingly enrolled in the program at all.
The Federal Trade Commission investigated and settled with GM: a five-year ban on sharing driver behavior and precise location data with consumer reporting agencies, a consent requirement covering the next two decades, deletion of previously collected data, and an option for drivers to shut off location collection. GM discontinued Smart Driver and ended the broker relationships. California and other states pursued their own cases on top of it.
The premium went up because the car talked. The driver found out from the bill.
What this means for you
The GM order constrains one company. The pattern is industry-wide, and the Mozilla review suggests the default assumption should be that a connected car collects broadly and shares onward unless you shut it off. Three moves are available today: review and disable the optional connected services and driver-score programs in your vehicle's app and infotainment settings, request your own file from LexisNexis and Verisk, which both operate consumer disclosure processes. Treat any dealership app enrollment as a data decision rather than paperwork.
A full vehicle privacy guide is in development and will land here first.
Sources
No list to join. The work just ships.
PDN keeps no mailing list, which is exactly how a privacy project should treat your inbox. New guides and Atlas entries land on this site first, dossiers too, and the podcast carries every announcement. A community space is planned once the audience earns it.