Automotive Data Privacy: The Sale of Driver Telemetry to Third Parties

Automakers are monetizing driver behavior through third-party data sales

Modern connected vehicles act as sophisticated data collection hubs, vacuuming up telemetry that automakers often sell to third-party data brokers and insurance companies. This practice allows companies to create risk profiles of drivers based on real-world behavior—such as speeding or nighttime driving—which can directly impact consumer insurance premiums.

The General Motors FTC Settlement

In early 2026, the Federal Trade Commission (FTC) imposed a five-year ban on General Motors (GM) regarding the sale of customer data to consumer reporting agencies and third-party data brokers. This unprecedented penalty followed allegations that GM collected extensive driver data via its OnStar connected services and the "Smart Driver" feature, then sold that information to brokers like LexisNexis and Verisk.

Key findings from the case include:

Lack of Transparency: Many drivers were unaware of the extent of data collection, having unknowingly consented through confusing enrollment processes.
Financial Impact: Reports indicate that some drivers saw their insurance rates increase as a direct result of the data shared by the automaker.
Regulatory Remedy: Under the settlement, GM is required to simplify the process for drivers to disable location tracking and provide mechanisms for users to access and delete their collected data.

The technical and legal landscape of vehicle telemetry

There is a critical distinction between vehicle-centric data and driver-centric data, though current regulations often conflate the two.

Vehicle vs. Driver Data

Vehicle Data: Includes the VIN, specifications, recall status, and odometer readings. This data is generally viewed as an authoritative record of the asset that persists across multiple owners.
Driver Data: Includes speed, precise location, and timestamps. This is the telemetry being monetized by OEMs to create behavioral profiles.

Emerging Legal Protections

Legislative efforts are beginning to target the sale of this sensitive information. For example, California Assembly Bill AB-1542 aims to make the sale and sharing of "sensitive" personal information illegal, specifically including geolocation data that can map an individual within a 1850-foot radius. This would effectively criminalize the sale of the type of driver telemetry currently being exploited by connected car manufacturers.

Consumer strategies for mitigating data collection

Users seeking to avoid automotive surveillance have adopted various technical and behavioral workarounds, though their effectiveness varies by vehicle make and model.

Technical Workarounds

Hardware Disconnection: Some users attempt to pull the OnStar fuse or disable cellular connectivity to stop data transmission. However, there are concerns that telematics may be stored in long-term local storage and batch-uploaded once connectivity is restored.
Software Opt-outs: Users have reported attempting to disable data collection via companion apps and infotainment settings, though some claim these are ineffective. One user reported that their vehicle continued to report accurate mileage to third-party services like Carfax despite all known data collection being disabled.
Platform Choices: Some users suggest that vehicles running Android Automotive may offer more transparent, tech-standard privacy policies compared to proprietary OEM notices.

Behavioral Alternatives

Analog Vehicles: There is a growing preference among privacy-conscious consumers for vehicles from the 1990s or early 2000s, which lack integrated cellular connectivity and "smart" telemetry systems.
Corporate Ownership: Some advocates suggest owning vehicles through an LLC to add a layer of friction against license-plate reading lookups and registration data sales by government agencies (e.g., DMVs).

Industry Perspectives and Counterpoints

While privacy advocates call for total bans on the sale of driver data, some industry sectors argue that telemetry provides essential utility:

"I work in grid management, and the Telemetry from EVs is a valuable data stream for steerable demand on the grid. The only data we need is is if you’re at home and the charging metrics /w commands. But the amount of unnecessary data that is available, is a real privacy concern."

This highlights a tension between the operational necessity of certain data (like EV charging metrics for grid stability) and the excessive collection of behavioral data for profit.