Your Car Is Selling Your Data

The Verge columnist Andrew Hawkins reminds us that the automobile long ago became a surveillance device — something most owners don't even suspect.

How it all began

Earlier this year, the U.S. Federal Trade Commission issued an unprecedented ruling against General Motors, barring the company for five years from selling customer data to credit bureaus and third-party brokers. For years, GM had been collecting information on how often drivers sped and whether they drove at night, and then passing it along to the brokers LexisNexis and Verisk, which work with insurers. Many drivers agreed to the data collection without realizing it — by signing up for the OnStar service with its Smart Driver feature.

According to a 2024 investigation by The New York Times, some car owners saw their insurance rates rise as a result, and the sign-up process itself was so convoluted that people didn't understand what they were sharing. Under the terms of the settlement, GM is now required to make it easier to turn off location tracking and to give customers a way to view and delete the data collected on them.

GM is far from alone, however. Researchers at the Mozilla Foundation studied the privacy policies of every major automaker and concluded that each of them has “terrible privacy and security.” A buyer is forced to accept several overlapping agreements at once — for the car itself, for its connected services, for the mobile app, and for the financial services. Consumer Reports later confirmed it: nearly every manufacturer selling in the U.S. collects and shares “driver behavior data.”

The problem with cars is worse than with smartphones: on a phone you can at least find the privacy settings, but in a car the data collection is smeared across a multitude of systems and documents.

What's happening now

After the GM penalty, the issue has finally drawn attention, but the policy response, in the author's view, misses the mark. The DRIVER Act, a bill introduced by Republicans, proclaims the principle that “if you own the car, you own its data,” yet it still allows manufacturers to collect and sell that information. As Jen Caltrider, a co-author of the Mozilla report, points out, the right to access and delete is not the same as a ban on excessive collection: the burden still falls on the individual.

It has even come to ideas like Transportation Secretary Sean Duffy's “freedom car” — the right to drive an “unconnected and non-automated” vehicle, with a ban on any requirement to equip cars with wireless data transmission, which, as Hawkins notes, no one is demanding anyway.

What comes next

The demand for simple cars is real: people ask why they can't buy an automobile without sensors and tracking, and they're taking a look at bare-bones concepts like the Slate Truck. A backup camera they're willing to accept — but total tracking and ads on the screen (hello, BMW) they are not. But manufacturers have a direct financial incentive to keep going: as long as there's money to be made from the data, no one is going to give it up voluntarily.

Technically, every manufacturer has a page for opting out of data collection — it's just buried under mountains of legal text.

Source: The Verge