Automakers are collecting extensive data on drivers and selling it to third parties, often without consumers’ clear understanding or consent. According to reporting by The Stepback, this practice has drawn regulatory attention after the Federal Trade Commission issued an unprecedented penalty against General Motors in 2024.
GM had been collecting driver data—including speeding frequency and nighttime driving patterns—through its OnStar connected services plan, specifically a feature called Smart Driver. The company then sold this information to data brokers LexisNexis and Verisk, which work with the insurance industry. The New York Times reported that some drivers saw their insurance rates increase as a result. Many vehicle owners were unaware their data was being collected and shared because the enrollment process was confusing, according to the source text.
The FTC settlement requires GM to make it easier for drivers to disable location tracking and access or delete their collected data. However, GM is far from alone in this practice. Researchers from the Mozilla Foundation examined privacy policies across major automakers in 2023 and found that every single one had “horrible privacy and security,” according to Jen Caltrider, who helped author the study. Consumer Reports reached the same conclusion, finding that “nearly every automaker that sells cars in the U.S. is similarly collecting and sharing so-called ‘driver behavior data’ with other companies.”
Vehicles present a unique privacy challenge compared to smartphones because data collection is spread across multiple systems and policies—covering the car itself, connected services, smartphone apps, and financial services. This fragmentation makes it extremely difficult for consumers to understand what information is being collected and how it’s being used.
Legislative efforts to address the issue have emerged but face criticism from privacy advocates. The DRIVER Act, introduced by House Republicans, would give vehicle owners more control over their data but would still allow automakers to collect and sell it to third parties. Privacy advocates argue this puts the burden on consumers to discover and delete data rather than preventing excessive collection in the first place. Meanwhile, the Trump administration’s proposal for “the Freedom Car” would ban requirements for automated driving systems and wireless data transmission, though according to the source text, no one is currently proposing such mandates.
Automakers have strong financial incentives to continue collecting data. As long as the data economy rewards companies for gathering and selling information, manufacturers are unlikely to voluntarily abandon the practice, despite growing consumer interest in simpler, less-connected vehicles.
Key facts
- The FTC penalized General Motors for selling customer driving data to insurance brokers without clear consumer consent
- Every major automaker examined by Mozilla Foundation researchers had ‘horrible privacy and security’ policies
- Data collection spans multiple overlapping policies—car, connected services, apps, and financial services—making it difficult for consumers to understand what’s happening
- Consumer Reports found nearly every U.S. automaker collects and shares driver behavior data with third parties
- The proposed DRIVER Act would give owners more control over data but still permit collection and sale to brokers