Modern cars have quietly become rolling data collection devices. Every trip generates location pings, speed readings, braking patterns, and sometimes even biometric details about the people inside.
Automakers use this constant stream of information for far more than diagnostics. It feeds insurance partnerships, marketing profiles, and outright sales to third-party data brokers.
Most drivers never see a consent screen for any of this. The data collection happens quietly through infotainment systems, connected apps, and onboard sensors that never stop running.
Thankfully, privacy laws in California and more than a dozen other states now give consumers real leverage. Since California became the first state to require companies to let customers opt out of data collection in 2020, fifteen other states have followed with similar privacy laws, with three more taking effect in 2026.
These laws let you formally demand that automakers delete, limit, or stop sharing your personal information. The requests are legally binding, not just polite suggestions buried in a privacy policy.
A 2023 Mozilla Foundation study of 25 car brands found that vehicles rank as the worst product category for privacy. That reputation has only grown as regulators dig deeper into how connected vehicles operate.
Enforcement actions against major manufacturers have made headlines throughout 2025 and 2026. Regulators now treat connected vehicle data as a serious consumer protection priority, not a niche technical issue.
Below are eight specific requests you can file with any automaker to force real action on your data. Each one targets a different part of the collection and sharing pipeline, so combining them gives you the strongest protection.
1. The Right to Delete Request
This is the most direct tool available to consumers. It asks the automaker, along with any service providers, contractors, and third parties, to permanently and completely erase your personal information.
The request covers more than just your own name and account details. It extends to driving history, location logs, and any behavioral scores tied to your profile.
Most major brands now accept this request through an online privacy portal. Subaru, Toyota, and others each run slightly different forms, but the core function is identical.
You typically need to verify your identity before the request gets processed. This usually means confirming your name, vehicle identification number, and account email address.
There are limits to what gets erased. Federal and state laws carve out a few exemptions, including tax records and vehicle ownership documentation.
Warranty records and safety recall information also tend to survive deletion requests. Automakers argue these categories serve legitimate safety and legal purposes beyond marketing.
Filing this request does not undo past sharing. It only stops future retention and use of the data already on file at the time of your submission.
If your data was already sold to a broker before you filed, that copy may persist elsewhere. This is why pairing deletion with an opt-out request matters so much.
2. The Right to Know What Data Was Collected
Before you can delete anything effectively, you often want to see what exists first. This request compels the automaker to disclose every category of personal data tied to your account.
That includes location history, driving behavior scores, and any biometric readings captured by cabin sensors. It should also reveal which third parties received copies of that data.
Consumer advocates note that these disclosure requests are typically grouped under labels like Right to Know, Right to Limit, and Right to Delete on automaker privacy pages. The exact terminology varies from brand to brand.
Reading the disclosure first helps you target your deletion request more precisely. You can see exactly which categories matter most before deciding what to remove.
Some brands respond within 45 days, matching state law deadlines set by California and similar statutes. Others take longer, especially for older account histories.
Complex requests often take longer because your data lives across multiple internal systems. Marketing databases, telematics platforms, and dealer service records rarely talk to each other cleanly.
This fragmentation is part of why disclosure requests sometimes come back incomplete. Following up with a second request after 60 to 90 days is a reasonable practice.
Keep a copy of whatever disclosure you receive. It becomes useful evidence if you later need to dispute inaccurate data or file a complaint with a state regulator.
3. The Right to Opt Out of Data Sale
Automakers frequently sell driving data to insurance companies and data brokers. This request stops that specific practice going forward, separate from full deletion.
Requests filed under this category are often labeled Right to Opt Out on automaker privacy sites, distinct from broader deletion demands. It targets the sale and sharing pipeline directly rather than existing records.
This matters because insurers use driving scores to set premiums. Hard braking events, late-night driving, and speeding patterns can all quietly raise your insurance costs without you knowing why.
Regulators have already pursued cases involving the unlawful sale of driving data collected from tens of millions of drivers to insurance analytics firms. These cases show the practice was widespread, not isolated.
Opting out of sale does not delete existing records automatically. You typically need to pair it with a separate deletion request for full effect on data already collected.
Some automakers frame these programs as optional insurance discounts rather than data sales. The underlying transaction, however, usually looks identical to a standard broker sale.
Reading the fine print on any usage-based insurance program is worth the effort. The discount offered rarely outweighs the long-term cost of your driving profile being sold indefinitely.
Filing this opt-out early, ideally right after purchasing the vehicle, prevents months of data accumulation. Waiting until problems arise means more history already sitting with third parties.
4. The Right to Limit Sensitive Personal Information
Precise location and biometric data get special legal treatment in many states. This request restricts how that specific category of sensitive information gets used or disclosed.
Under California’s privacy law, automakers must erase geolocation data on request, a genuine technical challenge for older vehicle systems never built with deletion in mind. Newer models handle this more smoothly through updated software architecture.
Sensitive categories usually include precise geolocation, biometric identifiers, and information about minors riding in the vehicle. Some laws also cover health-related inferences drawn from driving patterns.
Oregon recently strengthened protections in this exact area. Oregon’s updated privacy law now bars the sale of precise geolocation data and prohibits using data belonging to children under sixteen for targeted advertising.
This expansion matters for families with teen drivers or young passengers. Data collected about minors historically fell into gray areas that many automakers exploited.
Filing a sensitive data limitation request forces the company to separate this category from general marketing use. It cannot be bundled into broader advertising or profiling programs afterward.
Some automakers have started building dedicated toggles for sensitive data inside their apps. These give you granular control without needing to submit a formal written request each time.
Where that toggle does not exist yet, the formal privacy portal request remains your only reliable option. Push for written confirmation once the limitation takes effect.
Also Read: 5 Compact Trucks Worth Buying vs 5 to Skip
5. The Right to Disable Geolocation Collection
Beyond limiting use, you can request that the automaker stop collecting your location entirely. This goes further than restricting sale or sharing after the fact.
This right gained real teeth after a major federal settlement. The FTC’s finalized agreement with General Motors and OnStar requires the company to let customers disable geolocation data collection and opt out of it altogether.
That same settlement carries real weight for future conduct across the industry. It includes a five-year ban on disclosing geolocation and driver behavior data to consumer reporting agencies.
Other automakers are watching this case closely as a template. Regulators have signaled they expect similar consent mechanisms to spread industry-wide over the coming year.
Disabling geolocation collection typically disables features tied to it as well. Roadside assistance and stolen vehicle recovery often depend on this same continuous data stream.
Some brands offer a middle ground worth considering. You can sometimes disable background location tracking while keeping it active only during active emergency calls.
Ask your automaker’s support team directly whether this partial option exists. Not every brand advertises it clearly on the main privacy portal page.
Full geolocation disabling suits drivers who prioritize privacy over convenience features. Weigh how often you actually use remote start or stolen vehicle tracking before committing.
6. The Right to Delete Your Connected Services Account
Simply cancelling a subscription like OnStar or FordPass does not erase your history. This request specifically targets full account deletion, not just service cancellation.
Owners should separately request account deletion when available, since cancelling connected services alone only stops future collection. The existing data can remain on file otherwise, sometimes indefinitely.
This distinction trips up a lot of consumers. They assume turning off an app subscription equals full data removal, which is rarely how the underlying system actually works.
Cancelling a connected service like OnStar or Blue Link stops future collection, but the data already gathered and sold stays put unless you file a separate deletion request. Always submit both requests together.
Account deletion requests often require more identity verification than simple cancellation. Automakers want proof you are the actual account holder before wiping years of driving history.
This extra friction exists partly for legitimate security reasons. It also, unfortunately, discourages some consumers from completing the process at all.
Persisting through the verification steps is worth it. A cancelled subscription with retained data still leaves your driving profile exposed to internal marketing use and third-party sale.
If the automaker’s portal does not offer account deletion directly, escalate to customer support in writing. Reference your state’s specific privacy law by name to strengthen the request.
7. The Right to Data Portability
This request asks the automaker to hand over a copy of your data in a usable format. It is less about deletion and more about control before you delete.
Some manufacturers are building better export tools than they had even a year ago. Certain automakers’ 2025 updates let drivers export service histories to independent mechanics using blockchain-based records.
Portability requests help you keep useful records, like maintenance history, before wiping the rest of your account. This is especially relevant if you are selling the vehicle soon.
The FTC has published guidance reminding consumers to delete data from their cars before selling them, much like people already do with computers and phones. Portability plus deletion covers both bases at once.
Exported data can also help you catch errors before they cause problems elsewhere. If your driving score looks unfairly harsh, portability lets you review the raw numbers behind it.
Some insurance disputes have been resolved simply because a driver requested their raw telematics data first. Seeing the actual figures sometimes reveals sensor errors rather than genuine risky driving.
Requesting portability before a trade-in or sale is good practice generally. It gives you a personal archive independent of whatever the next owner’s account settings end up doing.
Not every brand supports full portability yet, especially for older vehicle models. Ask specifically what formats are available before assuming a complete export is possible.
8. The Right to Universal Opt-Out Signals
A newer legal mechanism lets you send one signal that applies across every company you interact with, including automakers. This removes the need to file separate forms with each brand you own a vehicle from.
Oregon’s requirement that companies honor universal opt-out signals took effect in January 2026, meaning every automaker operating there must honor consumer requests to access, delete, and opt out of data sales. Other states are adopting similar rules quickly.
This approach saves real time for consumers who own multiple vehicles or interact with several brands across a household. One signal, sent through your browser or a designated privacy service, covers them all.
The technology behind this typically runs as a browser extension or a dedicated privacy tool. It broadcasts your opt-out preference automatically whenever you visit a participating company’s website.
Universal opt-out tools are still relatively new and not every automaker recognizes them yet. Checking state-specific guidance before relying solely on this method is worth the extra step.
California was actually an early adopter of a similar concept through its Global Privacy Control standard. Automakers doing business there are increasingly expected to honor these automated browser signals.
If your state does not yet mandate recognition of these signals, sending one still cannot hurt. Some automakers voluntarily honor them even where not legally required.
Why These Requests Matter Now
Regulatory pressure on automakers has intensified sharply over the past two years. The FTC first signaled in May 2024 that it would scrutinize connected vehicle privacy risks tied to location data and other sensitive information.
That scrutiny produced real consequences fairly quickly. The FTC reached a settlement with General Motors and OnStar in January 2025 over how the companies collected and shared vehicle-generated data, including location and telematics information.
State regulators have moved just as aggressively, sometimes even faster than federal agencies. California officials announced a proposed settlement worth roughly $12.75 million with General Motors in May 2026 over allegations of selling location and driving-behavior data without proper consent.
Texas has pursued similar action against data brokers rather than automakers directly. The Texas Attorney General sued an insurer and its analytics affiliate in January 2025 over unlawfully collecting and selling driving data from over 45 million Americans.
Federal lawmakers are watching all of this closely too, though nothing binding has passed yet. The Auto Data Privacy and Autonomy Act, introduced in December 2025, would restrict manufacturers from accessing or sharing vehicle data without consent, though it had not become law as of July 2026.
Private litigation is rising alongside regulatory action as well. Plaintiffs’ attorneys are increasingly targeting issues like infotainment-system data extraction, persistent tracking, and undisclosed sharing of vehicle telemetry.
This combination of federal, state, and private pressure creates real incentive for automakers to respond properly. Companies that ignore consumer requests now risk far more than bad press.
The Trade-Offs You Should Expect
Filing any of these requests comes with a real cost worth understanding upfront. Many connected features depend directly on the data you are asking the company to delete or stop collecting.
Opting out of data sharing typically means losing features like roadside assistance, automatic crash detection, and the ability to remotely lock your doors through a smartphone app. Weigh this carefully before submitting a broad request.
Tesla owners face a particularly stark version of this trade-off compared to other brands. Opting out of Tesla’s data sharing entirely can cost you some Autopilot functionality, since certain software features stay gated behind the connected account.
Not every automaker treats hardware restrictions the same way either. Tesla’s cabin camera hardware cannot be physically disabled without voiding the vehicle’s warranty in some configurations.
This creates a genuine dilemma for privacy-conscious Tesla drivers. Disabling the camera feed risks warranty coverage, while leaving it active means continuous biometric monitoring inside the cabin.
Other brands are less aggressive but still tie meaningful features to data collection. Automatic emergency services and over-the-air software updates commonly require some baseline connectivity to function properly.
Consider filing a partial request first if full deletion feels too disruptive. Limiting sensitive data categories while keeping basic safety features intact is a reasonable middle ground for many drivers.
Checking Data Broker Records Too
Your car is not the only place your driving data ends up living. Companies like LexisNexis and Verisk compile driver risk reports drawn partly from automaker data feeds.
Consumers can file a free consumer disclosure request with these data broker companies separately from any automaker request. This closes a gap that automaker-only requests leave open entirely.
Insurance-focused data brokers assemble profiles used to set your premiums behind the scenes. Checking these reports periodically helps you catch errors or unauthorized data sharing before renewal time.
Filing with both the automaker and the relevant data brokers gives you the most complete picture available. Neither request alone captures everything currently held about your driving history.
These broker reports sometimes reveal surprising sources of data you never consented to directly. A rental car company or a previous vehicle owner’s account can occasionally leave traces in these files.
Requesting a copy annually is a reasonable habit, similar to checking your credit report. It costs nothing and often reveals errors worth disputing before they affect your insurance rate.
Looking Ahead at Vehicle Data Rules
Standardization efforts are underway that could eventually simplify all of this for consumers. Major automotive alliances have committed to adopting a unified vehicle data format by 2026, which could resolve long-standing compatibility problems between manufacturers.
A parallel international standard is also emerging alongside industry commitments. The International Organization for Standardization’s ISO 24089 standard is expected to unify vehicle data formats across the EU, US, and Asia-Pacific markets by 2026.
New federal safety mandates could complicate things further rather than simplify them, however. Upcoming biometric monitoring systems tied to a federal impaired-driving mandate are expected to sharply increase both the volume and sensitivity of data generated inside vehicles.
This expansion means privacy requests will likely become more important, not less, in the coming years. More sensors generally means more categories of data worth formally requesting deletion of.
Regulators are not backing off their enforcement pace either. Automakers should expect more aggressive federal and state enforcement in 2026, alongside growing pressure to demonstrate responsible data stewardship.
Manufacturers should also expect more state-specific rules layered on top of existing federal requirements going forward. This patchwork approach means your specific rights may keep expanding depending on where you live.
Also Read: 10 Cars That Need Dealer Software for an Oil Reset
