Your Car Is Collecting More Than You Think
If you drive a vehicle made in the last several years, it likely has cellular or Wi-Fi connectivity built in, whether or not you actively use any connected features. That connectivity means the vehicle can and often does collect data well beyond what’s needed for navigation or emergency services: precise location history, driving behavior (hard braking, speed, acceleration patterns), and in some vehicles, even data from cameras and sensors inside the cabin.
What’s Actually Been Documented
Privacy researchers and journalists have documented specific cases of automakers sharing detailed driving behavior data with data brokers, who in turn sold it to insurance companies for underwriting purposes, in some cases without consumers realizing they’d agreed to this through a connected-services enrollment they didn’t fully read. This led to real consumer complaints, at least one high-profile lawsuit, and increased regulatory scrutiny of automaker data-sharing practices. Several automakers have since adjusted their disclosure practices and opt-in flows in response to this scrutiny, though practices vary significantly by manufacturer and continue to evolve.
What Data Categories Are Typically Involved
- Precise location history, where you’ve driven, how often, and how long you stayed.
- Driving behavior, hard-braking events, speeding patterns, acceleration, used both for potential safety features and, when shared externally, for insurance risk assessment.
- Connected app and infotainment usage, what you’ve searched for, paired devices, sometimes even data synced from a connected phone.
- In-cabin sensor data in some newer vehicles, including camera-based driver monitoring in certain advanced driver-assistance systems.
What You Can Do
- Check your vehicle’s connected services and data-sharing settings, usually accessible through the manufacturer’s app or an in-dash settings menu, most manufacturers now offer some level of opt-out for data sharing with third parties, though disabling it may mean losing certain convenience features or usage-based insurance discounts.
- Review your automaker’s specific privacy policy, disclosure requirements and actual practices vary meaningfully by manufacturer, worth reading the specific policy for your vehicle rather than assuming a blanket industry standard.
- Understand the insurance tradeoff. If you’re specifically opted into a usage-based insurance discount program, that data sharing is the explicit basis for the discount, a different situation from data shared without a corresponding benefit to you. See our insurance and data brokers guide for more on this specific angle.
- For a used or unfamiliar vehicle, check whether the previous owner’s connected account and data access has actually been removed, some manufacturers require an explicit account transfer or reset process when a vehicle changes hands.
The Bottom Line
A modern connected vehicle is, among other things, a data collection device, and that data has demonstrably been sold to brokers and insurers in ways many owners never realized they’d agreed to. Checking your specific manufacturer’s connected services settings and privacy policy is worth the fifteen minutes it takes, particularly if you’d rather your driving behavior not become an underwriting input without your active knowledge.
Your VIN Is One of the Identifiers California’s DROP Accepts
If you live in California there is a step the settings-menu advice above does not cover.
A vehicle identification number is one of three optional device identifiers the state’s DROP
platform accepts, alongside a mobile advertising ID and a Connected TV ID, on top of the name,
date of birth and ZIP code that are the only required fields.[1] It is not
mandatory, and CalPrivacy is clear that a request works without it, but supplying an
identifier raises the chance a broker can match and delete the record it
holds.[2]
A VIN happens to be the easiest of the three to find. It is a 17-character code, readable
from a plate on the dashboard near the windshield or a sticker inside the driver’s side door
jamb, and it also appears on the vehicle registration, the title, and insurance
documents.[2] No app and no account are involved.
This lines up directly with the driving-behaviour data described above, because a VIN is
the key that telematics records are filed under. It is also the answer to the used-vehicle
question at the end of this article: buying a different car is one of the events CalPrivacy
names as a reason to return and update an existing DROP request, with updates permitted once
every 45 days.[1][3] One request reaches over 600 registered
brokers at no cost.[4]
References
- How DROP works. CalPrivacy, State of California
- Unique identifiers. CalPrivacy, State of California
- Help with DROP. CalPrivacy, State of California
- Delete Request and Opt-out Platform (DROP). CalPrivacy, State of California
