Modern cars do much more than provide transportation. Built-in connectivity, navigation systems, smartphone applications, and vehicle sensors can generate information about where drivers travel, how they behave behind the wheel, and which connected services they use.
Research published in September 2026 has intensified concerns about how this information moves between automakers, technology companies, and third-party data businesses.
A study involving connected vehicles and companion apps found that personal identifiers and location information were shared with outside companies in some cases.
The findings have renewed questions about informed consent, insurance decisions, and whether buyers fully understand the privacy trade-offs that come with connected-car features.
What Connected Cars Can Collect About Drivers
Connected vehicles use GPS receivers, telematics systems, and smartphone applications to support navigation, remote access, diagnostics, and vehicle monitoring.
Depending on the model, subscriptions, and settings, these systems may process journey histories, driving behavior, vehicle identification, and information from connected devices.
Some collection has practical benefits. Location data supports navigation and emergency assistance, while diagnostics can identify mechanical problems. The privacy question is what information is collected, why it is collected, who receives it, how long it is retained, and whether drivers have meaningfully agreed to those uses.
Research published by Northeastern University and Consumer Reports on September 29, 2026, examined 30 connected-car apps. Consumer Reports said 28 sent data to at least one outside advertising or analytics company.
Seven transmitted at least one piece of personally identifiable information, such as an owner’s name, vehicle identification number, or precise location, to an outside company. These findings concern the apps tested, not every connected vehicle.
Researchers identified technology companies, including Amazon, Google, Meta, and Microsoft, among recipients of vehicle-related information.
Some provide legitimate services, but data can still travel beyond the automaker and the driver-facing application. An outside recipient does not automatically prove misuse or sale, yet it raises questions about how widely information is distributed.
Drivers may expect navigation to require location access without realizing that identifiers or other personal details could reach multiple third parties. Privacy policies may describe these practices, but consumers can struggle to understand them when buying a vehicle or activating its connected services.
How Data Sharing Can Affect Insurance and Consumer Privacy
Driving information, including speeding, hard braking, mileage, and travel times, can help insurers assess risk. However, drivers may face unexpected consequences if information collected through connected services reaches third parties without their clear understanding and consent.
The issue became particularly visible through the U.S. Federal Trade Commission’s case involving General Motors and OnStar. In January 2025, the FTC alleged that GM collected precise location and driving-behavior data and shared it with consumer reporting agencies without adequately informing consumers or obtaining affirmative consent.
According to the complaint, some information was collected as frequently as every three seconds. The FTC said insurers could use resulting consumer reports when assessing coverage and setting rates.
In January 2026, the FTC finalized an order settling the allegations. The order prohibits GM from sharing certain geolocation and driving-behavior data with consumer reporting agencies for five years.
It also requires affirmative express consent for specified data collection, use, and sharing, subject to limited exceptions. Consumers must have ways to request copies of their data, seek deletion, and opt out of certain collection practices. The order applies for 20 years, with obligations specified in its terms.
The case shows why consent procedures matter. A driver might activate a service for driving feedback or emergency assistance without understanding that information could reach an outside reporting company. Data collected for one purpose can raise separate privacy concerns when used for another.
Insurance consequences are not automatic. They depend on what information is shared, who receives it, how it is used, and the applicable rules. Still, connected-car data could influence insurance decisions, making it important to understand the terms of driving-score programs and telematics services.
Location histories can also reveal homes, workplaces, regular appointments, and travel routines. In some circumstances, they may expose visits to sensitive places. If information is accessed improperly or shared inappropriately, the risks extend beyond advertising.
The FTC has warned that precise location information deserves strong protection because it can reveal sensitive details about people’s lives. Its guidance also makes clear that using a connected product does not give businesses unrestricted permission to collect and monetize personal information.
What Drivers Can Do and What Automakers Need to Explain
Drivers can reduce unnecessary data exposure without abandoning every connected feature. They should review vehicle and smartphone app settings, check which services are enabled, and establish whether sharing with third parties is optional.
Practical steps include:
Review permissions: Check location sharing, driving-score programs, personalized services, and marketing settings.
Read privacy notices: Look for data recipients, retention periods, deletion procedures, and possible insurance or advertising uses.
Disable optional features: Turn off unnecessary collection where the vehicle permits it.
Check driving programs: Ask whether braking, acceleration, mileage, and travel-time information stay with the automaker or reach insurers and data providers.
Erase personal information before selling: Remove paired phones, contacts, navigation destinations, and account credentials.
Factory-reset the vehicle where possible, and separately cancel or transfer subscriptions and unlink the manufacturer’s app. The FTC recommends these steps because personal information may remain after ownership changes.
These steps cannot guarantee that all information held by manufacturers or third parties will be deleted. Drivers seeking removal should consult the relevant privacy policy and submit a formal request where available. They should also distinguish data stored locally in a vehicle from information already transmitted to company servers.
Automakers need to explain their practices clearly when customers make decisions. A lengthy policy buried in an app may not adequately communicate what a service does. Companies should distinguish information needed to provide a requested function from data collected for optional analytics, marketing, or external sharing.
Consent should be meaningful. Drivers should understand what they are accepting, and declining optional data sharing should not automatically disable unrelated essential functions without a legitimate technical or legal reason.
Manufacturers should also offer accessible ways to review permissions and request access to or deletion of personal information where applicable.
Regulatory scrutiny is growing. The FTC’s action against GM and the September 2026 research by Northeastern University and Consumer Reports highlight concerns about how vehicle data reaches outside companies.
These findings do not establish that all automakers follow identical practices, but they show why connected-car privacy deserves attention.
Connected technology remains useful for navigation, diagnostics, emergency assistance, and remote vehicle functions. The challenge is ensuring those benefits do not come at the expense of informed choices.
As cars become more integrated with online services, privacy should be part of the ownership decision rather than a detail hidden in an application.
For buyers, comparing vehicles may increasingly involve more than price, fuel economy, safety, and infotainment. Understanding what a car records and how that information is shared can help drivers decide which services to activate and which permissions to decline.
