Is My Car Spying on Me? Yes, and It May Have Sold the Receipts to Your Insurer

Some drivers found out their car was tracking them the same way you find out about a hidden charge. Their insurance quote jumped, and nobody could explain why.

The reason, in a lot of cases, was sitting in the driveway. Modern cars log where you go and how you drive, and a long list of automakers reserve the right to share or sell that record. So yes, your car is very likely collecting data on you, and in some documented cases that data traveled from the dashboard to a data broker to the company setting your premium. Here is what actually gets collected, where it goes, and how to shut off the parts you can.

Is my car spying on me?

If it is newer than about 2018 and has a connected-services app or a built-in modem, assume yes. Not "spying" in the movie sense of a camera watching your face, though some cars do have interior cameras. Spying in the boring, profitable sense: your car generates a stream of data, and the company that built it decides who gets to see it.

You are not being paranoid, and this is not a fringe finding. In 2023 the Mozilla Foundation reviewed 25 major car brands and every single one failed its privacy test, which led Mozilla to call cars "the worst product category we have ever reviewed for privacy." Not one brand cleared the bar. That is the baseline you are buying into.

What your car actually knows

The data a connected car can generate goes well past speed and fuel level. Depending on the make and the features you turned on, it can include:

Precise location, logged continuously while you drive.
Driving behavior: hard braking, rapid acceleration, speeding, and what time of night you are on the road.
Anything your phone hands over when you pair it: contacts, call logs, and text message data pulled in for the infotainment system.
In-car sensor and camera data on some models, plus voice recordings if there is an assistant.

Mozilla found that 84% of the brands it reviewed said they could share your personal data and 76% said they could sell it. More than half, 56%, said they would share data with the government or law enforcement in response to nothing more than an informal request, no warrant required. And 92% gave drivers little to no real control over that data. Only two brands in the whole review, Renault and Dacia, offered people a way to have their data deleted, and those two only do it because European law forces the option.

The worst offender Mozilla named was Nissan, whose privacy policy claimed the right to collect categories as invasive as sexual activity, health diagnosis data, and genetic information. It did not explain how or why. That is a car company writing down that it can hold data about your sex life.

Follow the data off the car

This is the part the popular guides skip, and it is the part that actually costs you money. The data does not just sit with the automaker. It flows.

The path looks like this. Your car collects driving data. The automaker or its telematics partner packages it. It sells or shares that package with data brokers. Some of those brokers are consumer reporting agencies, the same kind of company that assembles your credit file. Insurers buy the reports and use them to set your premium or deny you coverage.

That is not a hypothetical chain. In 2024, reporting by Kashmir Hill at the New York Times revealed that automakers were feeding drivers' behavior data into exactly this pipeline, often through "smart driver" or safe-driving features people did not realize were scoring them. Two U.S. senators later summed it up in a letter titled, bluntly, that automakers sold driver data for pennies.

The receipt: GM logged driving every few seconds and sold it

If you want one case that proves the whole pattern, it is General Motors.

In January 2026 the U.S. Federal Trade Commission finalized an order against GM and its OnStar unit. The FTC alleged that GM collected precise geolocation data as often as every three seconds from vehicles across Chevrolet, GMC, Cadillac, and Buick, along with driving-behavior data like hard braking, speeding, and late-night trips, largely through OnStar and a feature called Smart Driver. GM then sold that data to consumer reporting agencies, and the FTC named LexisNexis Risk Solutions and Verisk Analytics as the recipients. Those firms compiled it into reports insurers relied on to price policies and, in some cases, refuse them.

The FTC order bans GM from selling geolocation and driver-behavior data to consumer reporting agencies for five years. It also requires GM to get affirmative consent before collecting connected-vehicle data, to let every U.S. driver request a copy of their data and have it deleted, and to give people a way to turn off precise geolocation collection. GM had already quietly shut down the Smart Driver program in April 2024, after the reporting hit.

Then the bill came. In May 2026, GM agreed to pay $12.75 million to settle a California case brought under the state's privacy law, the largest penalty issued under it to date. California alleged GM sold the personal data of hundreds of thousands of its drivers from 2020 through 2024 without proper notice or consent.

One company got caught. The Mozilla review says the practice is the industry norm, not a GM quirk.

What you can actually do about it

You cannot fully un-connect a modern car without losing features, and you should be honest with yourself about that trade. But you can cut off most of the selling. Here is the order I would do it in.

Turn off connected and "smart driver" features in the app first. Open your automaker's app (MyChevrolet, FordPass, Toyota app, and so on) and dig into the data or privacy settings. Disable trip recording, driving-score or "smart driver" features, and location sharing. This is the fastest way to stop the behavior scoring that feeds insurance.
Submit the three privacy requests to the automaker. Most now have a privacy portal. Look for three separate rights and use all that apply: the right to limit the use of sensitive data, the right to opt out of sharing and selling, and the right to delete. Opting out stops future sales. Deleting addresses what they already hold.
Pull your own file from the brokers. This is the step almost no guide mentions. Because the firms holding driving data, like LexisNexis Risk Solutions, operate as consumer reporting agencies, U.S. federal law (the Fair Credit Reporting Act) gives you the right to request your consumer report from them for free and dispute what is wrong. Request your report, check it for a driving-behavior or telematics entry, and file the broker's opt-out or "suppression" request while you are there. If your premium jumped, this is where you find out why.
Unpair your phone and wipe the car before it leaves your hands. When you sell, trade in, or return a rental, do a factory reset of the infotainment system and delete your phone from the paired-devices list. Otherwise your contacts, call history, and location favorites ride along to the next driver.
Skip the optional connected extras on the next car. The strongest move is at purchase. Every service you decline is a data stream that never starts.

What about a rental or someone else's used car?

Assume the last driver left their whole address book in it, and assume you will too if you are not careful. Rental and recently-sold cars are full of paired-phone data because almost nobody wipes them. Before you connect your phone to a rental, ask whether you actually need to. If you only want music, Bluetooth audio leaks far less than full "Android Auto / CarPlay" pairing, which pulls in contacts and messages. When you return the car, delete your phone from its Bluetooth list. On a used car you just bought, factory-reset the system before your first drive.

Where privacy-by-default comes in

Notice the shape of every fix above. Collection is on by default, and the burden is entirely on you to find each hidden switch and flip it off. That is the surveillance economy's whole trick. Opting out is a scavenger hunt, and most people never finish it.

The alternative is the reverse default: tools built so nothing is collected or shared unless you turn it on. At Secria we build consumer privacy products around that block-by-default idea, so the parts of your life that run on our systems, like your email, are private without a settings safari. We cannot fix your car. No app can. But the same principle you are applying to the dashboard, minimize what you emit and demand the right to delete, is the one worth applying everywhere you can actually control it.

Can I stop my car from collecting data completely?

Not entirely, not without disabling the modem, which usually kills safety features like automatic crash response. Opting out and turning off connected features stops most of the sharing and the behavior scoring, which is the part that gets sold. Some baseline diagnostic telemetry may still transmit, and automakers do not always let you confirm what runs in the background. You are reducing exposure, not reaching zero.

Does turning off location sharing stop everything?

No. Location is one stream. Driving behavior, paired-phone data, and voice data are separate, and each can have its own toggle. Turn off location, then go back through the privacy menu and shut down driving scores, data sharing, and anything tied to a "smart" or "connected" driving program.

Which cars are best for privacy?

Mozilla failed all 25 brands it reviewed, so there is no clean winner. The practical answer is that the fewer connected services a car has, and the more granular its opt-outs, the better. Renault and Dacia stood out only for offering deletion, and that is because European rules require it. Everywhere else, the privacy you get is the privacy you go in and configure.

Sources

Federal Trade Commission, finalized order and press release settling allegations that GM and OnStar collected and sold geolocation and driver-behavior data without consent (January 2026).
Mozilla Foundation, *Privacy Not Included: "It's Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy" (September 2023).
Kashmir Hill, The New York Times, reporting on automakers selling driver behavior data to the insurance industry (2024).
California Attorney General and Los Angeles County District Attorney, $12.75 million CCPA settlement with General Motors over OnStar driver data (May 2026).