What Your Car Knows About You (And Who It Sells It To)
Modern cars collect location, speed, and braking data continuously. Here's exactly what gets recorded, who buys it, and how to check what your specific car shares before you sign anything.
Mirko4 min read
On this page4 sections
This is the first deep dive in our car privacy series. The overview post covered the general trade-off between old and new cars. This one is about one specific thing: what a connected car actually records about you, and where that data goes after it leaves the vehicle.
The clearest public example
In May 2026, the California Attorney General fined GM $12.75 million for selling OnStar location and driving-behavior data to LexisNexis Risk Solutions and Verisk Analytics, two data brokers that most drivers have never heard of. Those companies repackaged the data and sold it to insurers, who used it to help price policies, without meaningful consumer consent along the way. A separate FTC settlement in January 2026 didn't include a fine, but it barred GM from sharing that category of data for five years and required 20 years of documented consumer consent going forward.
This wasn't a hack or a leak. It was the ordinary, intended function of a connected-car feature marketed to owners as a safety service. That's the part worth sitting with: the data pipeline from your car to an insurer's pricing model isn't a bug, it's a business line.
What actually gets recorded
Connected-car telematics is usually described as one feature, but it's really a bundle. Depending on the make, model, and trim, it can include continuous GPS location, speed at any given moment, how hard you brake and accelerate, seatbelt status, and in some newer trims, cabin cameras or microphones intended for driver-monitoring systems. Mozilla's Foundation reviewed car brands as a product privacy category in 2023 and rated it the worst category it had ever assessed, worse than fitness trackers, worse than smart speakers. Nothing in the years since has reversed that finding.
The mechanism that makes this valuable to insurers is usage-based insurance (UBI): programs that price your premium partly on how you actually drive, not just your demographic profile. If that pricing happens through a program you knowingly opted into, like a dongle you plugged in for a discount, that's a transparent trade. The GM case is different because the data left the vehicle through a factory-installed system, got sold to brokers, and reached insurers through a channel most drivers never explicitly agreed to.
Why an old car sidesteps this specific thing
A car without a cellular telematics module has no ongoing feed to sell. There's no OnStar-equivalent system generating a continuous stream of your driving behavior, so there's nothing for GM, or any automaker, to package and sell to LexisNexis or Verisk. This is the one part of the "old cars are more private" argument that holds up cleanly: it's not a workaround, it's the straightforward absence of a data source.
It's worth being precise about the limits, though. This only covers behavioral telematics, how you drive. It does nothing for location tracking that happens outside the vehicle, like automated license-plate readers, which is a separate system entirely and applies to any car regardless of age. That's the subject of the next post in this series.
How to check what your specific car shares
If you're buying newer and want to keep some connectivity without the data-sharing default, a few concrete steps help:
Ask the dealer directly whether the trim you're looking at shares driving data with third parties by default, and ask them to show you the settings screen, not just tell you verbally. Most manufacturers now have a data-sharing toggle in the infotainment settings or a companion app, a direct result of scrutiny following cases like GM's. Read the specific privacy disclosure for the trim and model year you're buying, not a general brand policy page, since data practices can change between model years even on the same platform. And if you're buying used, check whether the previous owner's account is still linked. Some connected-car systems keep transmitting to the manufacturer under the prior owner's account until it's explicitly transferred or deactivated, which means your car could be reporting your driving to someone else's data profile.
None of this requires giving up a newer, safer car to get some of the ground back. It requires knowing the toggle exists and asking for it before you sign, not after.