Modern vehicles can collect far more information than drivers may realize, from location histories and driving habits to details associated with smartphones connected to their infotainment systems.
A recent investigation by Northeastern University and Consumer Reports has renewed concerns about how automakers share this information with technology companies, advertising platforms, and data brokers.
The issue has also resurfaced following legal disputes over whether connected-car systems can capture private text messages and call information.
Although the dismissal of one lawsuit did not establish that automakers have blanket permission to intercept communications, researchers have documented the transmission of personal identifiers and location information through vehicle apps.
For American drivers, the central question is how much information their cars collect, who receives it, and whether they have meaningfully consented.
What Information Can Your Connected Car Collect?
Connected cars rely on GPS receivers, cellular connections, Wi-Fi, microphones, cameras, and vehicle sensors to provide services such as navigation, emergency assistance, remote locking, and vehicle diagnostics. These features can make driving more convenient, but they also create opportunities to collect information about a vehicle and its owner.
Depending on the model, connected services, and permissions, the information may include precise location, journey history, vehicle identification numbers (VINs), driving behavior, and details associated with a connected smartphone.
Some systems can also access contacts, call information, or messages when drivers enable particular smartphone-integration features. The information available to a vehicle depends on its software, the connected device, and the permissions granted by the user.
The privacy concern is not simply that this information exists. It is how it is stored, transmitted, and shared, and whether the driver understands those arrangements. Location data can help a navigation system find a destination, for example, but the same information can reveal regular journeys between home, work, and other places.
A study published on September 29, 2026, by researchers at Northeastern University in partnership with Consumer Reports examined 21 vehicles from 19 brands and their associated smartphone applications.
Researchers found that 19 of the 21 vehicles contacted at least one outside third party over Wi-Fi. They also tested 30 companion apps and found that 28 transmitted data to at least one external advertising or analytics company.
Seven apps sent personally identifiable information, including an owner’s name, VIN, or precise location, to an outside company.
The research identified companies including Amazon, Google, Meta, and Microsoft among recipients of vehicle-related information. Other recipients included analytics businesses and data brokers.
These findings do not prove that every company receiving data uses it improperly or that every transfer constitutes a sale. Some third parties provide technical services, while others help measure app usage or deliver advertising.
However, the researchers said privacy policies often did not clearly identify which outside companies would receive information or explain the specific purposes for each transfer. A policy stating that data may be shared with service providers can leave consumers with little practical understanding of where their information will go.
The findings also identified information being transmitted through several familiar automaker apps, including HondaLink, myChevrolet, myCadillac, myBuick, myGMC, myNissan, and the Lincoln app.
In some cases, VINs were sent alongside email addresses or location information. A VIN is not necessarily sensitive by itself, but linking it with other identifiers can make it easier to associate a vehicle with a particular person.
There is an important distinction between data collection and data sale. Researchers documenting a transfer to an outside company do not automatically establish that the information was sold or used to make decisions about a particular driver.
Nevertheless, the results show that connected-car data can travel beyond the manufacturer, making transparency and clear consent essential.
Can Cars Collect Text Messages and Affect Insurance Rates?
The possibility that connected vehicles can access private communications has attracted particular attention. When drivers pair a smartphone with a vehicle, they may enable functions that display messages, synchronize contacts, support hands-free calls, or read incoming notifications aloud.
Depending on the system and permissions, some information can be processed by the vehicle or its associated software.
That does not mean every connected car automatically records and transmits the full contents of every text message. The capabilities vary between manufacturers, infotainment systems, and smartphone platforms.
Drivers should distinguish between a system accessing information to provide a requested feature and a company retaining or sharing that information for another purpose.
A federal lawsuit involving Honda, Toyota, Volkswagen, and General Motors raised questions about whether connected-car systems could capture and store private text messages and call information. According to CBT News, the lawsuit was dismissed on a specific legal issue.
That outcome did not establish that automakers have blanket permission to intercept drivers’ communications, nor does it prove that every manufacturer collects text messages. The legal dispute nevertheless highlights how difficult it can be for consumers to understand what happens to information processed by connected systems.
Driving behavior presents a more clearly documented concern. Information about speeding, hard braking, mileage, and driving times can be used to assess driving patterns. If shared with third parties, such information may also become relevant to insurance decisions.
General Motors provides a prominent example. In January 2025, the Federal Trade Commission alleged that GM and OnStar collected precise location and driving-behavior data through connected services, including OnStar Smart Driver, without adequately informing consumers or obtaining affirmative consent.
The FTC said the information could include speeding, hard braking, and precise location, sometimes collected as frequently as every three seconds. According to the agency, information shared with consumer reporting companies could be used in reports that insurers relied on when evaluating coverage and setting premiums.
In January 2026, the FTC finalized an order settling those allegations. The order prohibits GM from sharing certain geolocation and driving-behavior data with consumer reporting agencies for five years.
It also requires affirmative express consent for specified collection, use, and sharing, subject to limited exceptions, and provides consumers with ways to request their data, seek deletion, and opt out of certain collection practices.
The order does not establish that every automaker follows the same practices, but it demonstrates the potential consequences of inadequate transparency.
The distinction matters to consumers because insurance premiums can change for many reasons, including claims history, location, vehicle type, and insurer pricing. An increase alone does not prove that connected-car data was responsible.
However, drivers enrolled in telematics or driving-score programs should understand whether their information can be shared with insurance companies or consumer reporting agencies.
How Drivers Can Protect Their Personal Information
Connected features offer genuine benefits, so avoiding every form of vehicle connectivity is not practical for many drivers. Instead, consumers can review which services they use and determine what information they are comfortable sharing.
Start with the vehicle manufacturer’s companion app. Check its privacy settings and permissions, particularly those involving precise location, driving scores, personalized services, and marketing.
Review the infotainment system’s smartphone settings to see whether contacts, call histories, and messages are synchronized. Disable optional access that is not needed for the features you use.
Drivers should also read the privacy notices for connected services and ask specific questions. Does the manufacturer share location information with analytics companies? Can driving behavior reach an insurer or consumer reporting agency?
How long is the information retained? Can the driver request a copy or deletion? These questions are more useful than relying on a general statement that the company protects customer privacy.
Before enrolling in a driving-monitoring program, check whether the service is optional and whether participation could affect insurance-related decisions. Some programs are designed to provide feedback or discounts, but the terms determine how information is collected and used.
When selling or trading in a vehicle, remove paired phones, saved contacts, navigation destinations, and personal accounts. Use the vehicle’s factory-reset process where available, and separately unlink the vehicle from the manufacturer’s app and transfer or cancel connected subscriptions.
A reset may remove information stored locally, but it does not necessarily erase data already transmitted to company servers.
Automakers also have responsibilities. Privacy notices should explain the purposes of collection, identify categories of recipients, and provide understandable choices. Information required to deliver a requested service should be distinguished from optional data used for advertising or unrelated analytics.
Customers should not have to decipher complex legal documents to understand whether their driving information could be shared with outside businesses.
The Northeastern University and Consumer Reports study shows that connected-car privacy involves more than a single automaker or a particular insurance program. Information may move through a network of manufacturers, app developers, analytics companies, and other service providers.
The FTC’s action involving GM and OnStar further demonstrates that unclear consent and the sharing of sensitive driving information can trigger regulatory action.
Connected technology can make vehicles safer and more convenient, but those benefits should not require drivers to surrender control over their personal information without understanding the consequences.
As cars become increasingly connected, buyers should consider privacy alongside price, fuel economy, safety and infotainment features. Knowing what a vehicle collects, where that information goes and how to control optional sharing can help drivers make better-informed decisions about the technology they use every day.
