Your car is selling your data
Many modern cars collect extensive personal driving data, often without drivers' full awareness, and then sell it to third parties like insurance companies, leading to potential rate increases.
Intelligence analysis by Gemini 2.5 Flash
Automakers are collecting vast amounts of data on how their customers drive, including speeding habits and night driving, and sharing it with data brokers. A Federal Trade Commission penalty against General Motors highlighted this issue, revealing that many drivers unknowingly consented through connected services, leading to calls for stronger privacy protections.
Imagine your car is like a nosy friend who watches everything you do while driving—how fast you go, when you brake, and even where you travel. Then, this friend secretly tells all that information to other grown-ups, like insurance companies, who might then make you pay more money. People are now realizing this is happening and want cars to stop being such tattletales, or at least let them decide what secrets their car can share.
Analysis
The revelation that modern vehicles are actively collecting and monetizing driver data represents a significant privacy challenge in the age of connected technology. While the convenience of connected services is often highlighted, the underlying data practices often remain opaque, leaving consumers vulnerable to unforeseen consequences, such as increased insurance premiums. This issue extends beyond individual privacy, touching upon the broader implications for how data generated by autonomous systems is managed, secured, and utilized.
General Motors
Earlier this year, General Motors faced an unprecedented penalty from the Federal Trade Commission, receiving a five-year ban on selling customer data to consumer reporting agencies and third-party data brokers. This action stemmed from GM's practice of collecting detailed driving data, including speeding frequency and night driving habits, through its OnStar connected services plan, specifically a feature called Smart Driver. This data was then shared with brokers like LexisNexis and Verisk, which work with the insurance industry, reportedly leading to higher insurance rates for some drivers, as highlighted by a 2024 New York Times investigation. The settlement mandates that GM simplify the process for drivers to disable location tracking and to access or delete their collected data, acknowledging the previous complexity and lack of transparency in their consent mechanisms.
Mozilla Foundation
The problem, however, is not isolated to General Motors. A comprehensive 2023 report by the Mozilla Foundation, which examined the privacy policies of all major car companies, concluded that every single automaker exhibited "horrible privacy and security." Jen Caltrider, a co-author of the study, noted the overwhelming complexity faced by consumers, who are often forced to accept multiple, overlapping privacy policies for the car itself, its connected services, associated smartphone applications, and even financial services related to vehicle loans. This fragmented approach makes it exceedingly difficult for drivers to comprehend the full scope of data collection, let alone manage their privacy settings effectively. Unlike smartphones, where privacy controls are generally more centralized and intuitive, vehicle data collection is distributed across various systems, exacerbating the challenge for consumers.
DRIVER Act
In response to growing public scrutiny, policymakers have begun to address the issue, though not without controversy. Last December, a group of House Republicans introduced the Data Rights for Information and Vehicle Electronics in Real-time, or DRIVER, Act. While the bill aims to empower vehicle owners with greater control over their data, affirming the principle that "if you own the vehicle, you should own the data it generates," privacy advocates view it as insufficient. Critics, including Caltrider, argue that merely providing access and deletion rights does not prevent the initial, excessive collection of data. They contend that the burden remains on the individual to navigate an arduous process to discover and request deletion, rather than establishing a system where automakers are restricted from collecting so much information in the first place. This legislative debate highlights a fundamental disagreement over the appropriate balance between data utility for automakers and fundamental privacy rights for consumers, with some advocating for a more radical shift towards 'disconnected' vehicles, as proposed by the 'Freedom Car' concept.
Key points
- General Motors received an FTC penalty and a five-year ban on selling customer data due to opaque data collection practices.
- GM's OnStar Smart Driver feature collected driving data, which was sold to data brokers LexisNexis and Verisk, impacting insurance rates.
- A Mozilla Foundation report found that all major car companies have 'horrible privacy and security' policies, with complex, overlapping consent forms.
- The DRIVER Act, proposed by House Republicans, aims to give vehicle owners more data control but is criticized by privacy advocates for not preventing initial data over-collection.
- Consumers are increasingly demanding simpler vehicles without extensive sensors and data transmission capabilities.
Increased public awareness and regulatory scrutiny, as seen with the FTC's action against GM, could lead to stronger consumer protections and more transparent data collection practices across the automotive industry. This could empower drivers with greater control over their personal data, fostering trust in connected vehicle technologies.
Despite legislative efforts like the DRIVER Act, current proposals may not go far enough to prevent excessive data collection, leaving the burden on consumers to navigate complex privacy settings. This could lead to continued exploitation of driver data, eroding privacy and potentially increasing costs for individuals without their full consent.
