Your car is selling your data
The Federal Trade Commission concluded that GM’s OnStar “Smart Driver” program harvested location, speed and night‑driving metrics and routinely sold the records to LexisNexis and Verisk, two brokers that feed insurance‑risk models. The agency’s settlement forces GM to make location tracking opt‑out buttons visible, and to provide a portal where owners can view, export or erase the data the company has already collected. This is the first time a regulator has imposed a multiyear prohibition on a major OEM’s data‑sale practices, signaling that the FTC views vehicle telemetry as personal information subject to consumer‑privacy rules.
The GM case is hardly an outlier. A Mozilla Foundation audit of every major car brand’s privacy notices found uniformly “horrible” security language, while Consumer Reports documented that virtually every U.S. seller of new cars captures and shares driver‑behavior data with third parties. Unlike smartphones, where privacy toggles sit in a single OS menu, automotive data pipelines span the infotainment head unit, the telematics module, the dealer‑financing portal and a suite of mobile apps, making it nearly impossible for owners to trace what is being sent. The incentive structure—high‑margin data streams sold to insurers, advertisers and analytics firms—means automakers have little financial reason to curtail collection, even as public awareness grows.
Legislators are now wrestling with how to balance consumer control against industry profit. The bipartisan DRIVER Act would codify owners’ rights to access and delete vehicle data but stops short of prohibiting the initial harvest, effectively leaving the burden on drivers to prune massive data sets after the fact. A separate “Freedom Car” proposal floated by the Transportation Department seeks to ban any mandatory wireless or autonomous capability, a move that would cripple future safety and OTA‑update features without addressing the underlying data‑broker ecosystem. Watch for amendments that could tighten collection limits, for class‑action lawsuits from drivers whose premiums rose after data sharing, and for niche manufacturers that market “offline” vehicles as a privacy differentiator.
Key Takeaways
The FTC’s five‑year ban on GM’s data sales is the first major enforcement action targeting vehicle telemetry as consumer data.
Mozilla and Consumer Reports independently confirm that every major U.S. automaker collects and sells driver‑behavior data, often through opaque, multi‑layered policies.
The DRIVER Act grants access and deletion rights but does not prevent the initial, large‑scale data harvest, leaving consumers to manage the fallout.
Emerging consumer demand for “offline” or minimally connected cars could create a market niche for manufacturers willing to forgo lucrative data‑broker contracts.
About the Source
This analysis is based on reporting by The Verge. Here is a short excerpt for context:
This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on cars, data privacy, and autonomous vehicles, follow Andrew J. Hawkins. The Stepback arrives in our subscribers' inboxes at 8AM ET. Opt in for The Stepback here. How it started Earlier this year, the Federal Trade Commission issued an unprecedented penalty against General Motors: a five-year ban on selling customer data to consumer reporting agencies and third-party data brokers. For years, GM had been collecting all sorts of data on its customers - such as how often they sped or whether they drove at night - and selling it to brok … Read the full story at The Verge.Read the original at The Verge
