Your Car May Be Spying On You. Here’s How to Get It to Stop.
General Motors was reprimanded by the federal government for collecting customers’ driving data and sharing it with other companies. Yet the practice continues among other big automakers.
If you drive a car made in the past five years, chances are it’s collecting reams of data about your driving—things like how quickly you accelerate, how hard you hit the brakes, and how fast you turn corners.
But many people don’t know that this data is being amassed—much less where it goes or how it’s used. General Motors was penalized in January for allegedly using its Smart Driver program to collect and sell its customers’ driving data without their knowledge or permission. The Federal Trade Commission ordered the automaker to not sell driver data for five years to consumer reporting agencies (or credit bureaus) such as Experian, Equifax, and TransUnion. But a Consumer Reports investigation finds that nearly every automaker that sells cars in the U.S. is similarly collecting and sharing so-called “driver behavior data” with other companies and continues to do so.
The end result is that your driving data often winds up in the hands of multiple companies and can be used to influence the insurance premiums and auto loan terms you’re offered online.
How Your Car Data Becomes a Treasure Trove
For years, some car insurers have offered their customers the option of getting a discount on their premiums for agreeing to share their driving data. To collect it, insurance companies would typically have you install a plug-in device on your car dashboard or download a smartphone app that tracked your location and speed.
By the 2020s, these telematics programs were becoming outdated. Vehicle internet-connected onboard computer systems now allowed automakers to more easily collect even more detailed driver behavior data—precise measurements of how fast you drive or how hard you hit the brakes or the accelerator pedal, among hundreds of other behaviors.
Automakers can use this data to understand how crashes happen and improve car safety features. But for them, collecting it also came to make sense from a business perspective. For example, at a 2023 industry conference in Detroit, a Hyundai executive said that customers who had the company’s Bluelink app were more likely to spend money to get their cars repaired at Hyundai dealerships and stay loyal to the brand. “We have seen that our current connected customers, on average, spend a certain percentage more with our company,” said the executive, Vijay Rao.
Both automakers and car insurance companies, in turn, use the aggregated data to create driver scores, which can be likened to credit scores. They “paint a picture about how risky a consumer is,” says Andrea Amico, who started Privacy4Cars in 2014 to allow people to find out what data has been collected about them by their car company.
Low driver scores can result in higher costs. The Consumer Federation of America, which researches car insurance telematics programs, says driver scores could, for example, unfairly increase rates for lower-income workers who work night shifts—a phenomenon that often disproportionately affects Black and Latino consumers. Similarly, data about the neighborhood you live in and where you drive can also be used against you. Just a few states—California, North Carolina, and Rhode Island—prohibit the use of most or all driver data to raise drivers’ insurance premiums.
Many drivers know little about the data brokers, or “vehicle data hubs,” that store their driving data. Most data brokers rarely broadcast who they are or what they do.
“The fact that there are so many companies interacting with private data that the car owner has no relationship with is exactly why car companies sharing with third parties is a problem,” says Thorin Klosowski, who researches digital privacy issues for the nonprofit Electronic Frontier Foundation. “Your driving data goes to a half a dozen companies you’ve never even heard of for reasons you’d perhaps never agree to if asked directly.”
LexisNexis Risk Solutions has partnerships with car companies like Kia and Mitsubishi, and has had one with Subaru. But it likely has a much bigger share of the driving data market than what’s publicly known. In a 2023 annual report, LexisNexis Risk Solutions said 86 percent of new U.S. auto insurance policies issued that year benefited from its products. Its revenue has climbed to more than $3 billion in 2023, with just under 40 percent of its business attributed to insurance clients.
Data brokers are being newly scrutinized, prompted, in part, by investigations by The New York Times, The Markup, and nonprofit groups into what driving data is being quietly collected, with little in the way of warnings or requests to consent to that data being shared. In January, the Texas Attorney General’s office sued Allstate and one of its subsidiaries, Arity, for allegedly collecting, using, and selling driving data of roughly 45 million Americans through embedded software on smartphone apps, which regulators say wasn’t properly disclosed to users. The apps that Allstate contracted with include Life360, billed as a family location safety app, and GasBuddy, which helps users find prices and discounts at gas pumps.
Yet many telematics programs and apps are still shrouded in secrecy even as driving data is bought, shared, and sold at dizzying rates. After the state of Oregon passed a new privacy law that went into effect in July 2024, allowing its residents to request a list of all companies that their personal data is shared with and sold to, nearly 400 Oregon residents asked Privacy4Cars to file such requests with carmakers last year.
Not a single automaker responded to Privacy4Cars with a list of companies, despite multiple requests.
In the future, some automakers could be forced to disclose more info about where your driving data is going. As part of its settlement with the FTC, General Motors is banned from selling driving data to consumer reporting agencies and will soon publish an online, regularly updated list of all other third-party companies it is sharing driver data with. GM, which discontinued Smart Driver before its government settlement was announced, said the new disclosures and other changes should give “customers more transparency and control.”
But GM’s ban and published list might not do much to reduce the sharing and selling of driving data or help drivers’ insurance premiums. Even the Consumer Data Industry Association, an industry trade group that supports data brokers, thinks so. In a letter sent this month to the FTC, the CDIA said, “Driving behavior data will still be used [emphasis theirs] in the marketplace, and it will still impact consumers’ insurance premiums.” The letter continued, “While consumers will know that they gave consent to GM to share data with insurers, they will not know if this data was even considered, if that data had an adverse effect, or even if GM was the source of that data.”
Photo: David McNew/Getty Images Photo: David McNew/Getty Images
How to Opt Out of Sharing and Delete Your Driver Behavior Data
In 2020, California became the first state to require companies to let their customers opt out of having their data collected, shared, and sold. Since then, 15 other states have followed California’s lead, enacting similar privacy laws and three more have laws set to go into effect in 2026. (For a state-by-state breakdown of your privacy rights, check out this guide from the International Association of Privacy Professionals.
As a result of those state laws, some companies, including a number of automakers, allow consumers across the U.S. to submit requests to limit the use of, opt out of sharing, and delete their personal data. Other automakers limit these requests to states with applicable privacy laws.
Consumer Reports is working to pass stronger privacy laws and petition automakers not to sell your data. Meanwhile, to limit the use of, opt out of sharing, and delete your data, there are three separate requests you can submit with your car company. They are often referred to by the following names: “Right to Opt Out,” “Right to Limit the Use and Disclosure of My Sensitive Personal Information,” and “Right to be Deleted” requests. (There are other requests you can make to simply review the data that they have already collected about you to correct potentially inaccurate information.)
Each automaker has a slightly different way for you to submit these requests—usually by filling out an online form or changing your privacy settings through a mobile app connected to your vehicle. There is almost always a trade-off when you opt out of sharing your data with your car company, including losing access to features like roadside assistance or crash detection or the ability to remotely lock your doors from your smartphone.
The three types of requests and how you can submit them:
Right to Limit the Use and Disclosure of My Sensitive Personal Information
This is a request to limit the use of your sensitive personal information—say, your driver’s license number, precise geolocation data, and biometric data, such as fingerprints and iris eye scans, to name a few—only in “necessary” or “reasonably expected” situations—for example, in response to a search warrant or subpoena from a law enforcement agency.
Right to Opt Out
This is a request to stop selling or sharing your personal info and data with any third-party company. This request covers both the initial recipient of your data—the automaker—and companies they share and sell the data to, including data brokers and insurance companies.
Right to Delete
This is a request to have your personal info and data “permanently and completely” deleted by the automaker, any service provider, third-party companies, and contractors. There are a few exemptions under federal and state laws, such as tax records and ownership info.
There are two good ways to go about filling out and submitting these requests:
Fill out an online form. Each automaker has its own privacy pages to submit these requests, and they differ slightly. We’ll use Subaru’s online privacy portal as an example. After filling out the required fields for name, home address, email address, and phone number, and an optional field for your car’s 17-digit VIN number, you select the specific privacy request(s) you want to make. You can read the description of each request type by clicking on the box on the left.
Change your privacy settings through a connected mobile app. Many digitally connected vehicles have synced mobile apps that control a customer’s data privacy settings. For example, Toyota and Lexus customers can log into the mobile app, select the person icon in the top right corner, select “Account,” select “Data Privacy Portal,” and select the vehicle for which they would like to change the settings.
This allows you to opt out of your data being collected and shared but it doesn’t delete the data. Other mobile apps allow you to turn off location sharing. For example, the Mitsubishi’s RoadAssist+ app, users go to the app’s settings menu and turn off the toggle switch for “Trip Recording.”
Editor’s Note: Our work on privacy, security, AI, and financial technology issues is made possible by the vision and support of the Ford Foundation, Omidyar Network, Craig Newmark Philanthropies, and the Alfred P. Sloan Foundation.
