A modern connected vehicle can generate location pings, hard-braking and speeding events, and — if it has a driver-monitoring camera — attention and gaze data, often shared with the automaker's telematics platform by default. Several US automakers faced public scrutiny after driving-behavior data was found flowing to consumer reporting agencies and, in turn, affecting individual insurance premiums, without clear driver understanding. No single federal US privacy law covers this yet; California, and a handful of other states, have the strongest applicable protections, while the EU treats most of this as personal data under GDPR by default. The clearest trend: check your car's data-sharing settings and any connected app's privacy dashboard rather than assuming defaults protect you.
At a glance
| Data type | Common use | Privacy concern |
|---|---|---|
| Location/GPS trail | Navigation, roadside assistance, theft recovery | Movement pattern profiling |
| Driving behavior (braking, speed) | Usage-based insurance, safety scoring | Can raise premiums without clear consent |
| Driver-monitoring camera data | Attention/drowsiness detection | Biometric-adjacent data, storage/retention unclear |
| Infotainment usage/voice data | Feature personalization, ads | Third-party sharing scope often unclear |
What a connected car actually collects
Nearly every new vehicle sold today ships with an embedded modem or pairs with a smartphone app, and that connectivity is what enables remote start, stolen-vehicle tracking, and over-the-air updates. The same pipe that enables those conveniences typically also carries location history, trip logs, and — for insurance-linked programs — braking, acceleration, and speed events. Vehicles with driver-monitoring cameras, now common under EU rules and increasingly standard on Level 2+ systems elsewhere, add a further layer: attention and gaze data that is more sensitive than a typical infotainment log.
How this data has already caused real problems
Investigative reporting in 2024 found that some US automakers had been sharing detailed driving-behavior data with consumer-reporting agencies, which in turn supplied it to insurers — resulting in individual drivers seeing premium increases they couldn't easily trace back to the source, because the data-sharing consent was buried in setup screens or connected-app terms. Several automakers have since paused or restructured these data-sharing arrangements following public and regulatory pressure, but the underlying capability to collect and share this data hasn't gone away — it's now more a matter of default settings and disclosure.
Where the rules currently stand
| Region | Current approach |
|---|---|
| US (federal) | No comprehensive federal connected-car privacy law; relies on FTC unfair-practices authority and state laws |
| US (state) | California (CCPA/CPRA) gives the strongest individual rights to access, delete, and opt out of sale of this data; other states have narrower or emerging laws |
| EU/UK | Covered by GDPR/UK GDPR as personal data by default, requiring a lawful basis and giving drivers access and deletion rights |
What to actually check on your own vehicle
- The automaker's connected-services or privacy settings menu, usually in the infotainment system or companion app
- Whether usage-based insurance or driving-score programs are opted in by default versus requiring explicit enrollment
- What happens to driver-monitoring camera data — whether it's processed only on-device or transmitted and stored
- Data retention and deletion options, which vary significantly by automaker
Turning off location services in your phone doesn't turn off your car's own embedded telematics modem. The two are separate systems with separate settings.
The direction this is heading
Expect more states to pass connected-vehicle-specific privacy provisions, more automakers to add clearer opt-in dashboards after the 2024 backlash, and continued tension between the safety case for data collection (theft recovery, crash reporting, driver monitoring for regulation compliance) and the commercial case (insurance partnerships, targeted offers). The practical trend for owners is the same either way: read the connected-services agreement at purchase or lease signing rather than after a data-sharing story makes headlines.
Frequently asked questions
Can I opt out of my car sharing driving data?
Does my car's driver-monitoring camera record and store video?
Can driving data affect my insurance without my knowledge?
Is there a federal connected-car privacy law in the US?
Does turning off my phone's location stop my car from tracking me?
Sources & further reading
- Federal Trade Commission — Connected Cars
- California Privacy Protection Agency — CCPA/CPRA
- European Commission — GDPR overview
Figures, prices and policy details were current at the last-updated date above. Automotive pricing, incentives and regulations change frequently — verify time-sensitive details with the linked primary sources. Read our editorial policy and fact-checking standards.
