Modern connected cars can collect far more information than many drivers realize. Location, trip routes, speed, hard braking, acceleration, and other driving events can be captured through built-in telematics systems and connected apps.
However, the phrase “sell your trip history by default” needs an important qualification: not every vehicle listed necessarily sells identifiable trip data automatically to an insurer, and privacy settings, model year, connected-service enrollment, and state law can change what happens.
Consumer Reports found that nearly every major automaker it investigated collects some form of driver-behavior data, while the FTC’s case against General Motors documented the sale of precise location and driving data to third parties. The cars below represent systems with documented data-sharing concerns.
1. Chevrolet Silverado
The Chevrolet Silverado is one of the clearest examples of how a connected vehicle can generate detailed driving information.
General Motors’ OnStar system has historically collected information from connected GM vehicles, and the FTC’s investigation into GM documented the collection of precise geolocation and driver-behavior information through connected services.
The agency said some vehicles transmitted location data as frequently as every three seconds, while the associated driving data could include speed, hard braking, hard acceleration, seat-belt use, and other events.
The important point is that this does not mean every Silverado currently sends its owner’s trip history to an insurance company.
GM discontinued OnStar Smart Driver in 2024, and the FTC finalized an order in January 2026 requiring GM to obtain affirmative consent before collecting, using, or sharing covered connected-vehicle data, with limited exceptions.
The order also requires mechanisms allowing U.S. consumers to request their data and seek deletion.
The Silverado is relevant because it demonstrates how much information a connected pickup can potentially generate. A trip is no longer just an odometer increment. With connected telematics, a vehicle can produce records tied to time, location, vehicle identity, and driving behavior.
Consumer Reports’ broader investigation found that GM was not unique. The publication reviewed privacy practices from 15 major automakers and found widespread collection and sharing of driver-behavior data across the industry.
For a Silverado owner, the key question is therefore not simply whether the truck has OnStar. It is whether connected services are active, what consent was provided, and what privacy controls are currently available for that specific vehicle.
2. Kia Telluride
The Kia Telluride illustrates a different side of connected-car data collection because Kia has been identified by Consumer Reports as one of the automakers involved in partnerships surrounding driving data.
CR specifically reported that LexisNexis Risk Solutions has partnerships with automakers including Kia, while its broader investigation found that connected vehicles can collect information such as acceleration, braking, speed, and location.
That does not mean every Telluride owner automatically has a complete trip history sold to an insurance company.
The exact data collected and shared can depend on the connected-service configuration, consent settings, model year, and applicable state privacy law. That distinction is essential because the privacy landscape is changing quickly.
The Telluride’s connected ecosystem is built around Kia Connect, which provides features such as remote vehicle controls, vehicle status information, roadside assistance, and other connected services. Those capabilities require the vehicle to communicate information outside the car, creating the infrastructure through which telematics data can be collected.
Consumer Reports found that many automakers obtain permission through privacy agreements or connected-service enrollment, but consumers may not always understand the extent of the information involved.
The publication noted that some drivers simply accept consent screens when activating their infotainment system or mobile application without reading the associated terms.
For Telluride owners, the important question is therefore whether Kia Connect is active and what permissions have been granted. Consumers should review Kia’s current privacy controls rather than assuming that disabling one infotainment feature stops every form of connected-data collection.
The Telluride case also demonstrates why “default” can be misleading. A vehicle may technically have the hardware capable of collecting trip information, while actual sharing depends on enrollment and consent. That makes the connected-service settings just as important as the vehicle itself.
3. Mitsubishi Outlander
The Mitsubishi Outlander is another vehicle connected to a documented data-sharing ecosystem, although the details are more nuanced than simply saying Mitsubishi “sells your trip history.”
Consumer Reports found that Mitsubishi’s Road Assist+ roadside-assistance application was developed with LexisNexis Risk Solutions, a major data and analytics company.
According to CR’s investigation, information from the app could include hard braking, nighttime driving, and highway and local speeding events, and that information could enter LexisNexis’s telematics exchange.
That matters because these are not merely mechanical statistics such as engine temperature or tire pressure. Driving-behavior information can reveal how, when, and where a vehicle is being operated. Consumer Reports reported that LexisNexis has partnerships with multiple automakers and that its telematics products are used by numerous insurance companies.
However, the wording of the headline requires caution. The documented Mitsubishi arrangement involved the Road Assist+ application, rather than evidence that every Outlander automatically sends a complete trip history to insurers simply because the vehicle exists.
The exact data flow can depend on the connected service, application enrollment, model year, and consent provided by the owner.
That distinction is increasingly important because automotive privacy practices are changing. Consumer Reports found that automakers frequently describe data sharing in lengthy privacy policies and connected-service agreements that consumers may accept without fully understanding them.
For an Outlander owner concerned about privacy, the first step is to determine which connected applications and services are active. Do not assume that disabling a single infotainment feature necessarily disables every telematics function.
The bigger lesson from the Outlander is that the app connected to the vehicle can matter just as much as the vehicle itself. A service originally designed for roadside assistance can potentially become part of a much broader data ecosystem.
4. Subaru
Subaru is another automaker that appeared in Consumer Reports’ investigation into connected-car driving data. CR examined privacy policies and industry relationships involving 15 major automakers, including Subaru, and reported that LexisNexis Risk Solutions had previously had a relationship with Subaru involving driving data.
The important detail is what kind of information can become valuable. Modern connected vehicles can generate records involving acceleration, braking, speed, cornering, trip information, and location.
Consumer Reports explained that telematics companies can combine such information into driver-risk profiles, potentially creating information that insurers and other businesses may find useful.
That does not establish that every Subaru automatically sells an identifiable record of every trip. The exact practices vary by model year, connected-service enrollment, privacy agreement, and the particular service being used.
Subaru has also changed its connected-service and privacy practices over time, so an older article about a specific telematics arrangement should not automatically be applied to every current Subaru.
Still, Subaru’s inclusion in the Consumer Reports investigation makes it relevant to this discussion. The investigation found that almost every major automaker it examined was collecting some form of driving-behavior information, while many companies were reluctant to identify every outside organization receiving that data.
For owners, the practical issue is consent. Connected features such as remote vehicle access, emergency assistance, navigation services, and smartphone integration can require communication between the vehicle and outside servers. Turning off some forms of data sharing may also affect certain connected functions.
Consumer Reports recommends that owners investigate their automaker’s privacy controls and use available rights to request, limit, or delete personal information where applicable.
The Subaru example therefore highlights a broader reality: owning the vehicle does not necessarily mean controlling every piece of data generated by its connected systems.
5. Toyota RAV4
The Toyota RAV4 is a particularly interesting case because Toyota has acknowledged that connected services can involve driving-related information, while Consumer Reports found that Toyota’s data ecosystem was more complicated than a simple “Toyota sells your trips” description suggests.
CR reported that Toyota does not directly sell driver data to third-party companies, but its affiliate, Connected Analytic Services (CAS), can operate as a consumer reporting agency and sell driving data to insurers when a customer provides consent through a Toyota mobile app feature.
That distinction matters. The RAV4 should not be described as automatically selling every owner’s trip history. The documented concern involves connected services, data-sharing arrangements, and consumer consent.
The information involved in modern telematics can include driving behavior and location-related information, which can be considerably more revealing than the basic mechanical data stored by an older vehicle.
Consumer Reports also reported that CAS had partnered with Arity, a data company created by Allstate, to incorporate mobile tracking technology into certain driving and fuel-price applications.
The broader investigation found that automakers frequently share data with affiliates, service providers, and other businesses, although many companies did not publicly identify every recipient.
For a RAV4 owner, the practical issue is therefore connected-service enrollment and privacy consent. A driver who activates Toyota’s connected features should understand what data is collected and which choices are available.
Toyota’s example also shows why the word “sell” needs careful handling. Data can move through an automaker’s affiliate or service-provider network without the automaker itself directly selling it.
From a consumer’s perspective, however, the result can still be significant if driving information reaches organizations that use it for analytics or insurance-related purposes.
6. Mitsubishi Eclipse Cross
The Mitsubishi Eclipse Cross is relevant for a different reason than simply having a connected infotainment system. Consumer Reports’ investigation identified Mitsubishi’s Road Assist+ application as part of a data-sharing arrangement involving LexisNexis Risk Solutions.
CR reported that Road Assist+ data could include hard braking, nighttime driving, and speeding events on highways and local roads. That information was placed into LexisNexis’s telematics exchange, which has insurance-company partners.
The important qualification is that this does not prove every Eclipse Cross automatically transmits a complete record of every journey.
The documented system involved the Road Assist+ application, and CR reported that Mitsubishi itself did not receive the roadside-assistance data. The exact data flow therefore depends on the service and how it is configured.
For privacy-conscious owners, this distinction is important because a smartphone application connected to a vehicle can become another source of driving information. A person might think of a roadside-assistance app as something that only calls for help after a breakdown, while its underlying technology can involve additional telematics information.
Consumer Reports specifically noted that Mitsubishi’s Road Assist+ app included a trip recording control. Its guidance explains that users could go into the app’s settings and turn off trip recording.
That provides a useful lesson for Eclipse Cross owners: privacy controls may exist outside the vehicle’s dashboard. Simply changing the infotainment settings may not address data collected through a separate smartphone application.
The broader issue is that modern vehicles can have several connected layers operating simultaneously: the vehicle’s cellular modem, manufacturer account, roadside-assistance service, smartphone application, navigation functions, and third-party services.
A driver concerned about trip-history privacy should therefore check every connected service associated with the vehicle, not just the touchscreen settings.
7. Kia Sorento
The Kia Sorento belongs on this list because Consumer Reports identified Kia as one of the automakers involved in connected-driving data relationships, including a partnership with LexisNexis Risk Solutions.
CR’s investigation found that modern telematics systems can capture information such as acceleration, braking, speed, and location, then transmit that information into broader data ecosystems.
The important qualification is that saying a Sorento “sells your trip history by default” would be too broad. The documented evidence does not establish that every Sorento automatically sends an identifiable record of every journey to an insurance company.
Instead, the concern centers on connected services, data-sharing arrangements, and the permissions consumers provide when activating those services.
That distinction matters because a connected vehicle can perform useful functions at the same time it generates valuable information. Remote locking, vehicle-status checks, navigation, emergency assistance, and smartphone connectivity all require some communication between the vehicle and outside systems.
Consumer Reports found that many automakers rely on privacy agreements that consumers may accept while setting up their vehicles or mobile applications. The organization noted that drivers frequently agree to these terms without realizing how extensive the resulting data collection can be.
For a Sorento owner, the sensible approach is to review the connected-service account rather than assuming the vehicle’s privacy settings are completely controlled through the infotainment screen.
Consumer Reports notes that some automakers provide privacy controls through their mobile applications, including options to limit sharing or request deletion where applicable.
The Sorento therefore represents a broader privacy issue rather than proof that every owner is being secretly tracked. The vehicle’s connected capabilities can generate valuable behavioral information, and understanding the permissions attached to those services is essential.
8. Hyundai Santa Fe
The Hyundai Santa Fe completes this list because Hyundai was among the automakers examined by Consumer Reports in its investigation of connected-vehicle driving data. CR found that nearly every major automaker it examined was collecting some form of driver-behavior information, including data related to acceleration, braking, speed, and other driving patterns.
Hyundai’s connected ecosystem includes Bluelink, which provides services such as remote vehicle access, vehicle information, navigation-related functions, and emergency assistance. These features require the vehicle to communicate data outside the car.
The existence of that connection does not automatically mean every Santa Fe owner has their trip history sold to an insurer, but it illustrates why connected-service privacy deserves attention.
Consumer Reports specifically reported that automakers can use driver data for multiple purposes and that data can potentially reach third-party companies, including businesses involved in insurance telematics. The investigation also found that many automakers did not publicly identify every company receiving driving information.
That makes the consent process particularly important. A driver may activate connected features for something as simple as remote starting or checking the vehicle’s fuel level while accepting a privacy agreement at the same time. CR found that consumers often agree to such terms without understanding the full scope of the data practices involved.
There is also a broader legal development worth watching. Consumer Reports reported that multiple states have enacted privacy laws giving consumers rights to limit, opt out of, or delete certain personal information, although the precise rights vary by jurisdiction.
For Santa Fe owners, the practical step is to review the Hyundai connected-service account and privacy settings, particularly if the vehicle has been enrolled in telematics services.
The Santa Fe therefore belongs on this list not because every example is proven to sell trip data automatically, but because Hyundai’s connected ecosystem demonstrates how ordinary vehicle features can create a much larger data trail than many drivers expect.
9. Nissan Rogue
The Nissan Rogue deserves a place on this list because Nissan has publicly documented the kinds of information that its connected vehicles can transmit.
Nissan’s current U.S. privacy notice states that connected vehicles equipped with NissanConnect Services may electronically transmit precise geolocation, navigation information, speed, distance, driving behavior, vehicle usage, and diagnostic information. That means the data trail can contain substantially more than a simple record of vehicle mileage.
There is an important qualification, however. Nissan’s current privacy policy says the company does not sell sensitive personal data, including precise geolocation, or disclose it for targeted advertising.
Therefore, it would be inaccurate to claim that every Rogue automatically sells a complete trip history. The documented concern is that connected-vehicle data can be collected and transmitted, while the exact use and sharing depend on the applicable service, settings, and privacy terms.
Historically, the privacy picture was more complicated. LexisNexis announced in 2019 that Nissan North America had joined its Telematics Exchange, a system designed to make automaker mileage data available to participating insurance carriers for usage-based insurance programs.
Consumer Reports subsequently included Nissan among the automakers it investigated for connected-driving data practices.
For Rogue owners, this makes the connected-service account particularly important. A driver using NissanConnect may be permitting information to leave the vehicle as part of services they deliberately activated.
The bigger lesson is that a modern Rogue can generate a surprisingly detailed digital record of how the vehicle is operated. Before assuming that turning off a single dashboard feature stops data collection, owners should review Nissan’s current privacy controls and connected-service settings.
10. Ford F-150
The Ford F-150 is another important example because Ford’s own current privacy documentation openly explains that connected vehicles can transmit information associated with a VIN or other unique identifiers.
Ford says the information collected depends on the vehicle’s equipment, connectivity technology, software, connected services, data-sharing settings, and the selections made by the owner.
Ford’s privacy notice also states that certain 2020-model-year and newer vehicles automatically transmit Vehicle Analytics and specific types of vehicle data to Ford at delivery. That does not mean Ford automatically sells an identifiable trip history to insurers.
In fact, Ford says customers can decline certain connected-vehicle information sharing, although doing so can prevent some connected services from functioning correctly.
The distinction between collection and sale is critical. Consumer Reports’ investigation found Ford among the 15 major automakers it examined for connected-driving data practices. CR reported that nearly every automaker investigated was collecting some form of driver-behavior information, although the companies differed in how they used or shared it.
Ford also states that customers can direct connected-vehicle information to third parties through applications or services integrated with the vehicle’s infotainment system or connected mobile applications. In those situations, the third party’s own privacy policy can apply to the information being shared.
That makes the F-150 particularly relevant because its connected ecosystem can involve more than Ford itself. A driver can potentially create additional data-sharing relationships by linking outside applications or services.
For owners who value privacy, the first step is to review FordPass and the vehicle’s connected-service settings. Consumer Reports notes that opting out can sometimes mean losing conveniences such as remote features or other connected functionality.
The F-150, therefore, should not be described as a truck that secretly sells every trip by default. The more accurate conclusion is that it is a highly connected vehicle capable of generating and transmitting substantial vehicle information, making privacy settings and consent important parts of ownership.
