Connected Car Privacy: What Your Vehicle Records and Who It Sells It To

Your car knows where you slept last night. It knows how hard you brake, how fast you take corners, whether you wear your seatbelt, and which contacts are saved on the phone you paired with it three years ago. Modern vehicles are rolling data centres with wheels, and most drivers have never once looked at what their car collects or who it is shared with.

This is not a fringe concern. In 2023 the Mozilla Foundation reviewed the privacy policies of 25 major car brands as part of its Privacy Not Included research and failed every single one — the worst result of any product category the organisation had ever assessed. Since then, regulators in the United States and Europe have opened investigations into how driving data ends up with insurance brokers and data brokers, often without the driver ever knowingly agreeing to it.

Here is what your vehicle actually records, where it goes, and the practical steps that put you back in control.

What a Connected Car Actually Collects

The data falls into four broad buckets, and most drivers are only aware of the first one.

1. Location and trip history

Any car with a built-in cellular modem — which now includes most vehicles sold since roughly 2018 — logs GPS coordinates continuously. Not just where you parked, but the entire route, timestamps, and how long you stayed. Some manufacturers retain this history for years. If your car has an app that shows you "where did I park?", it is storing that data somewhere other than your car.

2. Driving behaviour telemetry

Acceleration, hard braking events, cornering force, speed relative to posted limits, time of day you drive, and seatbelt use. This is the data that has caused the most controversy, because it is directly commercially valuable to insurers. In 2024, reporting in the United States revealed that several manufacturers had been feeding driver-behaviour scores to data brokers, who resold them to insurance companies — and drivers discovered it only when their premiums jumped.

3. Everything from your paired phone

When you connect a phone over Bluetooth or plug it into the USB port, many infotainment systems copy your entire contact list, call log, and text message history to the car's internal storage. That copy stays there. It survives you selling the car unless you explicitly wipe it.

4. Cabin and sensor data

Microphones for voice commands, interior cameras in driver-monitoring systems, seat occupancy sensors, and on some models even data inferred about passengers. A handful of manufacturer privacy policies have included startlingly broad language about inferences relating to health, genetic information, or sexual activity — clauses that exist because policies are written to be maximally permissive, not because the car is measuring those things directly.

Where It Goes After It Leaves the Car

Three routes matter.

• The manufacturer. Data flows to the brand's cloud for the connected services you signed up for, plus product development and, in many policies, marketing.
• Data brokers and insurers. This is the route drivers object to most. It usually happens through a "safe driving" or "driver score" feature buried in the app, which drivers enable at the dealership without understanding it, or which a salesperson enables on their behalf during setup.
• Law enforcement and subpoenas. Vehicle location logs and event data recorder output are routinely requested in investigations and civil litigation. Whether a warrant is required varies significantly by jurisdiction.

There is also a fourth route people forget: the next owner. Rental cars and resold vehicles frequently still contain the previous driver's contacts, home address in the navigation favourites, and garage door opener pairing.

Warning Signs Your Data Is Being Shared More Widely Than You Think

• Your insurer offers a discount that references your actual driving without you installing any device or app from them.
• The manufacturer's app has a "driving score", "trip insights", or "safe driving" section that is switched on and shows historical data you never asked it to collect.
• Your car's connected-services subscription renews automatically even though you never use remote start or remote unlock.
• The infotainment system shows contacts from a phone you no longer own.
• The vehicle app account is still linked to a dealership email or a previous owner's account.

How to Lock Down Your Vehicle's Data

Step 1: Read your own privacy dashboard first

Most major brands now have a privacy or data page inside the vehicle's touchscreen settings, and a matching section in the mobile app. Look for menus named Data Privacy, Data Sharing, Connected Services, or Data Collection. Go through every toggle. The defaults are almost always "share".

Step 2: Turn off driver-behaviour sharing specifically

This is the single highest-impact switch. It is usually labelled something friendly — driving score, driver feedback, smart driver, trip analytics. Turning it off does not disable safety features like automatic emergency braking; it disables the telemetry that gets scored and sold.

Step 3: Submit a data request

If you are in the EU, UK, California, Colorado, Virginia, or a growing list of other jurisdictions, you have a legal right to request a copy of what the manufacturer holds and to demand deletion. Search for "[your brand] privacy request" or "[your brand] data subject request". Ask for two things: a full copy of the data, and a list of third parties it has been disclosed to. The second request is the one that produces the uncomfortable answers.

Step 4: Check with your insurer, not just your carmaker

Ask your insurance company directly whether they purchase driving data from third-party providers and whether any is attached to your policy. If a broker has been feeding them a score, you are entitled in most jurisdictions to see it and dispute it. Consumer reporting agencies that compile driving-behaviour reports are required to give you a free copy on request in the US.

Step 5: Stop over-pairing your phone

Use Bluetooth audio only where possible, and decline the prompt to sync contacts and messages. If you have already synced, go into the infotainment Bluetooth settings, delete the paired device, and confirm that contact sync data is deleted with it — those are often two separate operations.

Step 6: Factory reset before you sell, and again when you buy

Do a full system reset from the infotainment settings, then verify: check the contact list, navigation favourites, saved home address, paired devices, garage door remotes, and any linked accounts such as streaming or fuel payment. Also remove the vehicle from your manufacturer app account — a reset of the car does not always unlink the cloud account.

Step 7: Treat rental and courtesy cars as public terminals

Never pair your phone with a rental. Use a cigarette-lighter USB adapter or a power-only cable for charging rather than the car's data port. If you did pair, delete your device from the car's Bluetooth list and clear navigation history before returning it.

If It Already Happened

If you discover your driving data has been shared with an insurer or broker without meaningful consent:

1. Screenshot everything — the app settings showing the feature enabled, the data it displays, and the dates covered.
2. Request the file from any consumer reporting agency involved, and formally dispute inaccurate entries in writing. Disputes must be investigated within a defined window in most jurisdictions.
3. Send a deletion request to the manufacturer citing your applicable privacy law, and ask them to instruct downstream recipients to delete as well.
4. Complain to the regulator — your national data protection authority in Europe or the UK, your state attorney general or the FTC in the US. Regulator complaints are what produced the current wave of investigations in the first place.
5. Shop your insurance if your premium moved. A score you did not consent to is not a score you have to live with.

The Bottom Line

Cars became connected devices faster than privacy expectations caught up, and the industry defaulted to collecting everything because nobody stopped it. The good news is that most of the exposure is controlled by a handful of switches that take about twenty minutes to find, plus a data request email that costs you nothing.

Do the twenty minutes this week. Then do the same audit on any car you buy, sell, or rent — because the person before you almost certainly did not.