Your Car Is Secretly Selling Your Driving Data

If you drive a late-model car, it is almost certainly generating a behavioral trail: hard braking, rapid acceleration, speeding events, nighttime driving, trip patterns, and precise location history. The part most drivers miss is where that trail can end up. It is not just “for safety features” or “to improve the app.” In the U.S., driving data increasingly flows into partner networks and data marketplaces that can influence the price you get for insurance, and sometimes the offers you see for financing.

This is no longer a niche privacy argument. Federal regulators have now put real pressure on the ecosystem. In January 2026, the FTC finalized an order tied to General Motors and OnStar, including a five-year ban on sharing certain driver data with consumer reporting agencies and long-term requirements around consent and consumer controls. That’s the signal: the government is treating vehicle data like high-risk consumer data, not like harmless telemetry.

Why this is suddenly a big deal

For years, “telematics” mostly meant an insurance dongle or a tracking app you knowingly installed to try to get a discount. That era is fading. The modern shift is that the car itself can be the sensor, and the data can be packaged and routed through third parties you have never heard of. Consumer Reports’ analysis found that many major automakers operating in the U.S. collect and share driver behavior data, often under consent flows that most people click through without understanding the downstream use.

Once that data leaves the automaker, it can become difficult to track, difficult to audit, and difficult to delete. That’s the practical risk: not a single app, but a chain.

How your data actually moves (the short version)

Think of the pipeline in layers:

• First layer: the vehicle and its companion app. Connected services, infotainment systems, WiFi hotspot features, safety services, and roadside assistance can all create data exhaust.
• Second layer: affiliated companies and service providers. Automakers often describe sharing with “affiliates” or “service providers,” which can be broad categories. Consumer Reports found automakers frequently declined to name specific recipients even when describing their sharing practices.
• Third layer: exchanges, brokers, and analytics platforms. This is where the value extraction happens. Telematics “exchanges” and data brokers can aggregate data across sources and sell risk signals to insurers and other partners.
• Fourth layer: insurance pricing and underwriting workflows. At this point, the data is no longer “your trip history.” It becomes a score, a flag, or a set of risk attributes that can affect what you’re offered.

The GM case made the quiet part loud

The FTC’s GM/OnStar order matters because it describes the alleged pattern regulators are now targeting: consumers being enrolled or nudged into data collection without clear, informed consent, followed by data sharing that consumers didn’t expect.

The final order includes a five-year ban on disclosing certain driver data to consumer reporting agencies, plus long-term requirements around consent, transparency, and consumer rights controls.

Translation for drivers: you should assume other automakers and partners are watching this closely, and that “default-on” data practices are now a regulatory liability, not just a revenue opportunity.

“But it’s de-identified”

Automakers often say they share “de-identified” or aggregated data. That can reduce risk in some contexts, but it’s not a universal shield. Driving behavior and location patterns are inherently identifying when combined with time, geography, and a device or vehicle identifier. Consumer Reports’ investigation highlights how widespread collection and sharing is across the market, regardless of the labels used.

If you’re a consumer, the practical question is not “is it anonymized?” The practical question is “can this be used to make a decision about me?” If it can, the risk is real.

The other pressure point: data brokers and app-based tracking

The car is not the only source. Regulators have also targeted app-based location and movement tracking used for insurance-related analytics. Texas sued Allstate and its subsidiary Arity in 2025, alleging unlawful collection and sale of location and movement data through software embedded in mobile apps.

Even if the facts are ultimately litigated, the direction is clear: attorneys general are willing to treat “quiet tracking for insurance use” as a consumer protection and privacy enforcement issue, not just a contractual dispute.

What you can do now without turning your car into a brick

You’re not going to delete modern connectivity from a modern vehicle. But you can reduce data flow and tighten controls. The goal is to stop passive sharing you didn’t knowingly opt into.

1) Turn off the automaker “driving behavior” program first

Many brands have an optional driver scoring or “smart driver” feature buried inside the connected services menu or the brand app. If you see anything framed as:

• driver score
• safe driving program
• usage-based discount
• trip recording
• analytics or “improve services” tied to driving behavior

Assume it’s a data pipeline. Disable it. Many people effectively consent through quick setup screens on infotainment or apps, then forget the setting exists.

2) Limit location sharing and precise GPS access

In the car and in the companion app, reduce “precise location” permissions where you can. Some features (stolen vehicle recovery, emergency crash response, navigation, remote services) may degrade or stop working. That’s the trade: convenience vs data minimization.

A practical compromise many privacy experts recommend is leaving emergency services on (if you value them) while disabling ongoing trip logging or “behavior insights” that are not essential for safety.

3) Opt out of “sale” and “sharing” where your state law allows it

In 2026, the U.S. privacy landscape is still a patchwork, but it’s expanding. Multiple states have comprehensive privacy laws in effect, and more laws and amendments took effect or updated in 2026.

Why this matters: in states with strong privacy rights, you can often submit requests to opt out of certain data sharing/sale and request deletion, at least from the automaker’s side.

4) Request deletion, but expect exceptions

Deletion requests are worth doing, but don’t treat them like a magic erase button. Companies may retain certain data for legal, safety, fraud prevention, warranty, or compliance reasons. The point is to reduce unnecessary retention and prevent future sharing.

5) Clean up your phone as well

If your car brand app has access to location, motion/activity, Bluetooth, or “always on” permissions, it can create its own trail separate from the vehicle. Tighten those permissions. If you don’t need the app, uninstall it.

And be extra skeptical of “gas price,” “family tracking,” or “driving helper” apps that ask for constant location access. The Texas suit around app-based data collection is a reminder that the app layer is part of the same ecosystem.

A realistic checklist you can follow in 15 minutes

Conclusion

Driving data is being treated like a behavioral credit file for risk. It can help some drivers who genuinely drive gently and want a discount. It can punish drivers whose life forces them into “risk markers” (night shifts, dense traffic, harsh braking in urban stop-and-go). Consumer advocates have been warning that the sharing ecosystem is broad and poorly disclosed, and regulators are now acting on the most aggressive versions of it.