Modern cars can do far more than transport people. Connected vehicles can communicate with cellular networks, smartphones, navigation systems, apps, and cloud services, creating new streams of information about where a vehicle goes and how it is used.
The Federal Trade Commission has warned that connected vehicles can collect sensitive information, including precise location, biometric information, and data about driving behavior.
Privacy policies can also authorize broader collection and sharing than many drivers expect. Importantly, not every car collects every type of information, and a privacy policy describing what a company may collect does not prove that the information is collected from every vehicle or every driver.
1. Privacy Policies Can Reserve the Right to Collect Sensitive Information
The first place drivers can see the potential scope of automotive data collection is often the privacy policy attached to a vehicle, mobile application, or connected service. These documents can cover information generated by the vehicle itself, information supplied through a smartphone, and information provided when an owner creates an account.
A 2023 investigation by Mozilla’s Privacy Not Included project reviewed the privacy practices of 25 major car brands. Mozilla reported that the policies it examined allowed companies to collect categories of information that went far beyond basic vehicle diagnostics or maintenance records.
Depending on the brand, the policies described information such as precise location, driving behavior, health information, genetic information, demographic information, and other highly personal data.
Mozilla also reported that information could be gathered through vehicle sensors, microphones, cameras, connected services, applications, and devices linked to the vehicle.
That finding needs an important qualification. Mozilla’s research examined what the policies allowed or described, not proof that every company was collecting every listed category from every American driver.
Saying that automakers “collect your genetic information” as a universal fact would therefore be too broad. A more accurate description is that some policies reserve the right to collect or process highly sensitive categories of information under specified circumstances.
The Federal Trade Commission has separately acknowledged that connected vehicles can generate personal and sensitive information, including precise geolocation, biometric information, and information associated with vehicle occupants.
For drivers, the privacy policy therefore matters before the car is even driven. It can reveal what information a manufacturer says it may gather, why it may use that information, which service providers may receive it, and what choices consumers have concerning collection or sharing.
2. Connected-Car Telematics Can Record Where You Drive
A connected car can turn ordinary driving into a continuous stream of digital information. Telematics systems combine vehicle electronics with communications technology, allowing information to move between the vehicle and outside services.
Depending on the system, that can include location, speed, hard braking, acceleration, and other driving characteristics.
The Federal Trade Commission’s 2025 action against General Motors and OnStar provides one of the clearest documented examples in the United States. The FTC alleged that GM collected precise geolocation information from millions of vehicles and, for some vehicles, gathered location data as frequently as every three seconds.
The agency also alleged that driving behavior information, including hard braking, speeding, and late-night driving, was collected and shared with consumer reporting agencies.
The FTC’s complaint provides more detail about the technical process. It alleged that, beginning at least in 2018, a particular software task collected and transmitted precise latitude and longitude data every three seconds after ignition was switched on for affected vehicles.
The complaint said the transmitted information could also include elevation, heading, current speed, a timestamp, and a trip identifier.
This does not mean every connected vehicle constantly records its driver’s position at a three-second interval. The documented three-second example relates specifically to the GM and OnStar system described in the FTC’s complaint.
The case also demonstrates why driving data can be much more revealing than a simple odometer reading. A sequence of location points can reconstruct a journey, while repeated records of braking, acceleration, or speeding can describe driving behavior.
Such information may be useful for navigation, emergency assistance, diagnostics, or insurance-related services, but its collection also creates significant privacy considerations.
In January 2026, the FTC finalized an order involving GM and OnStar. The order requires affirmative express consent for covered connected-vehicle data collection, use, or sharing, subject to limited exceptions, and gives U.S. consumers mechanisms to request their data and seek deletion.
3. Smartphone Apps Can Become Another Source of Driving Data
The data trail does not necessarily begin inside the vehicle. A driver’s smartphone can become another source of information about trips, locations, and driving behavior, particularly when an app has permission to access location services or incorporates third-party tracking technology.
A major U.S. case involving this issue emerged in January 2025, when Texas Attorney General Ken Paxton sued Allstate and its subsidiary Arity. The lawsuit alleged that Allstate obtained driving-related information through tracking software embedded in mobile applications and used the information for insurance-related purposes.
According to the Texas Attorney General’s office, the data covered more than 45 million consumers nationwide and amounted to trillions of miles of location information. These are allegations contained in the state’s lawsuit, not findings that have been established against Allstate through a final court judgment.
The complaint focused on software that Allstate’s data analytics business, Arity, allegedly supplied to app developers. Texas identified applications including Life360, GasBuddy, Fuel Rewards, and Allstate’s Routely among apps involved in the allegations.
The state claimed the software could gather information about the movement and location of users’ phones and that the information was used to build driving profiles.
The distinction between a car collecting data and a phone collecting data is important. A vehicle may generate information through telematics, cameras, sensors, and onboard computers. A smartphone can generate another stream independently, and an app can potentially connect that information with an identifiable account.
The Federal Trade Commission has also warned that connected cars and related applications can involve sensitive information such as precise location and other personal data.
For drivers, that means checking an application’s privacy permissions can be just as relevant as reading the privacy settings for the vehicle itself. Turning on location access may provide useful navigation or safety features, but it can also create another pathway through which information about a person’s movements can be collected.
4. Event Data Recorders Keep a Short Crash History
The device commonly called a car’s “black box” is more accurately known in the United States as an event data recorder, or EDR. Unlike a connected-car telematics system designed to communicate information over time, an EDR is primarily concerned with what happens immediately around a crash.
The National Highway Traffic Safety Administration defines an EDR as a device that records technical vehicle and occupant information for a short period before, during, and after a crash. Depending on the vehicle and applicable requirements, information can include vehicle dynamics, driver inputs, restraint use, and airbag deployment information.
NHTSA specifically distinguishes an EDR from systems that continuously make audio or video recordings.
Federal regulations specify data elements for vehicles equipped with EDRs. These include vehicle speed, accelerator or throttle position, service-brake status, and the driver’s seat-belt status. The information is recorded for a limited period surrounding the crash rather than functioning as a permanent diary of every trip.
The rules are also changing. NHTSA’s December 2024 final rule increased the required pre-crash recording period from five seconds at two samples per second to 20 seconds at 10 samples per second.
The Department of Transportation subsequently published a proposal concerning the compliance date and phase-in of those requirements.
That makes the phrase “black box” somewhat misleading if it creates the impression that a vehicle is continuously recording everything happening inside the cabin. An EDR is much narrower. NHTSA describes it as a device intended to capture technical information surrounding a specific event.
There is another interesting part of the history. In 1997, NASA’s Jet Propulsion Laboratory recommended that NHTSA study the feasibility of using crash recorders to obtain vehicle data for safety analysis. NHTSA’s history therefore includes an aerospace connection, although today’s automotive EDR system should not be described as a NASA invention.
For accident investigators, that short burst of technical information can be valuable. It can help establish what the vehicle was doing immediately before impact and how its safety systems responded, turning a few seconds of electronic information into evidence about a crash.
5. Infotainment Systems Can Store Phone and Account Information
The screen in a modern dashboard can function as much more than a radio and navigation display. When a driver connects a smartphone to a vehicle, the infotainment system can become another place where personal information is processed and, in some circumstances, stored.
The Federal Trade Commission has specifically identified connected-car infotainment systems as a potential source of personal information. In its examination of connected vehicles, the agency noted that systems can allow drivers to access applications, connect to the internet, use navigation and music services, and access contacts from a connected phone.
The information involved can include browsing activity, app usage and communications associated with the phone connection.
This creates a distinction between data produced by the vehicle and information brought into the vehicle by its occupants. A navigation system might generate location information as part of providing directions, while a paired smartphone could introduce contacts, destinations, music preferences or other account-related information into the car’s digital environment.
The FTC has also warned that modern vehicles can contain cameras, microphones, GPS receivers and support for third-party applications. That combination gives connected vehicles capabilities that resemble those of other internet-connected devices.
There is an important practical issue when a vehicle changes ownership. A driver might remove the phone but forget to delete previously stored information from the vehicle.
The FTC has advised consumers to wipe personal information from connected cars before selling or transferring them, much as they would remove information from a computer or smartphone.
That can include removing paired devices, clearing navigation destinations, deleting contacts and signing out of connected accounts where the vehicle provides those functions. The exact information retained varies by manufacturer and infotainment system.
For drivers, the takeaway is straightforward. A car’s touchscreen is not necessarily just a temporary display. Depending on the vehicle and its systems, it can become part of the digital record created during everyday driving.
6. Vehicle Sensors and Cameras Can Generate Information About the Cabin
Some of the newest vehicles contain an extensive collection of sensors designed to understand what is happening around and inside the vehicle. Cameras can monitor road conditions and driver attention, while microphones can support voice commands. Other sensors measure vehicle operation, occupancy or environmental conditions.
The Federal Trade Commission has described connected vehicles as increasingly similar to other sophisticated connected devices because many contain cameras, microphones, GPS receivers and internet connectivity.
The agency has specifically identified biometric, telematic, geolocation and video information among the categories of data that can potentially be collected through connected vehicles.
Driver-monitoring systems provide a particularly clear example. Some vehicles use interior cameras or related sensors to determine whether the driver is looking toward the road and whether the person appears attentive.
NHTSA research involving driver-support systems has itself involved vehicle cameras and other sensing equipment, illustrating how modern vehicles can produce substantial quantities of visual and technical information.
That does not mean every car continuously records or uploads everything its cameras see. The technology varies considerably between vehicles, and the presence of a camera does not by itself establish that footage is permanently stored or transmitted to an outside company.
Data handling depends on the vehicle’s hardware, software, connected services and privacy practices.
The same caution applies to microphones. A microphone may be necessary for hands-free calling or voice commands, but its presence does not automatically mean conversations are being permanently recorded. What matters is how the particular system processes, stores and transmits audio.
NHTSA’s earlier federal automated-vehicle policy also recognized that vehicle technologies can involve geolocation, biometric and driver-behavior information and emphasized transparency, consumer choice, data minimization and security.
For American drivers, therefore, the privacy question is becoming increasingly specific. It is no longer simply whether a car is connected to the internet. It is which sensors are installed, what information they generate, how long that information is retained, and which companies can access it.
