Your car is a smartphone on wheels — and it phones home
A jargon-free look at what a modern car records during an ordinary commute, who ends up holding that data, and what it has already cost some drivers.
Think about an ordinary commute. Nothing eventful — you drive to work, park, drive home.
Here is what a connected car can produce from that non-event. Where you were, continuously, with timestamps. How fast you went, and where. Every press of the brake pedal firm enough to count as “harsh”. Every acceleration brisk enough to count as “rapid”. Whether your seatbelt was on. What was playing. What you said to the voice assistant, including the false starts. And if you paired your phone — which you did, because that is what the screen is for — potentially your contacts, call logs and messages, synced into the car to make the hands-free work.
You would not accept a phone app that demanded all of that. In a car it is not an app you install. It is the floor you walk in on.
The people who read the paperwork
In 2023 the Mozilla Foundation reviewed the privacy practices of 25 car brands — spending around 600 hours on the policies — for its Privacy Not Included guide. All 25 failed. Cars became the worst-scoring product category the project had ever reviewed, below smart speakers, below doorbell cameras, below reproductive-health apps.
Some detail from the policies themselves, because it is hard to believe otherwise: Nissan’s stated that it could collect information including sexual activity, health diagnosis data and genetic data. Kia’s mentioned “sex life”. Hyundai’s said data could be shared with law enforcement on the basis of informal requests. And Tesla’s opt-out warned that switching off vehicle data collection could leave the car with reduced functionality, serious damage or inoperability — an opt-out phrased as a threat.
Nobody reads a privacy policy at a car dealership. That is not a character flaw. It is the design.
- 01 you drive to work the only part of this you actually notice
- 02 the car records it position, speed, braking, cornering, seatbelt, what was playing
- 03 it leaves with the manufacturer uploaded over the car's own connection; you cannot watch it go
- 04 it is packaged and priced brokers and insurers buy access, which is why step 02 exists
You never see the file. For most of the drivers this has happened to, the first sign it existed was a renewal quote.
The part that stopped being hypothetical
For years this was a “could” story. Then, in early 2024, the New York Times reported what General Motors had actually been doing with a feature called Smart Driver — a free driving-score gadget inside its connected-car apps.
According to the FTC’s later complaint, GM collected location data from some drivers as often as every three seconds, and sold driving-behaviour data on millions of vehicles to two data brokers, LexisNexis and Verisk — companies whose customers include insurers. One driver’s LexisNexis file ran to 258 pages and itemised 640 individual trips, with start and end times. Drivers reported premium jumps they could not explain — in one reported case, around 80 per cent — because nobody had told them their brake pedal had become a data source.
Many of those drivers did not knowingly enrol at all. Regulators concluded the sign-up flow was misleading, often completed in a hurry at the dealership.
The consequences are still landing. GM killed Smart Driver in April 2024, days after the reporting. In January 2026 the FTC finalised an order barring GM from sharing driver behaviour and location data with consumer reporting agencies for five years, and requiring affirmative consent for connected-car data collection for twenty. In May 2026, California announced a $12.75 million settlement over the same conduct — noting GM had made roughly $20 million nationwide from the sales. Texas, meanwhile, has pursued not just carmakers but the insurance side of the pipeline.
And GM is simply the company that got caught first and documented best. The brokers it sold to are in the business of buying.
Who owns it, then?
Morally, most people think the answer is obvious. When the FIA surveyed drivers about connected cars, nine in ten felt the data belonged to them, and about as many wanted a switch to turn the connectivity off. Almost no car offers that switch.
Legally — and here the UK is genuinely better placed than the US — the data about you is personal data under UK GDPR. You have the right to ask any manufacturer for a copy of what they hold, to have it corrected or erased, and to object to processing, and they have a month to respond. Sharing your driving behaviour with an insurer needs a proper legal basis, not a buried paragraph. These rights are real, and exercising a subject access request on a car manufacturer once is an education.
But rights you must invoke, one request at a time, against a default that collects everything, is not ownership. Ownership in practice belongs to whoever holds the servers. That is the whole disagreement, in one sentence.
Being fair about it
Connectivity in cars is not a scam. Automatic emergency calling after a crash saves lives. Stolen-vehicle tracing works. Over-the-air fixes spare you a garage visit, and a serviced, monitored car is genuinely safer.
The objection is not the feature. It is that the feature came bundled with a resale business you were never really asked about, and that opting out — where it is possible at all — is buried, penalised, or phrased as a warning.
What can you actually do? Treat the connected-services screens at handover as a contract, because they are one. Say no where a no is offered. Ask the manufacturer what it holds on you — in the UK, that question has legal weight. And notice which parts of this you can simply take home: location history is the most sensitive stream a car produces, and it is one you can keep on your own hardware instead of anyone’s cloud, recorded by you, readable by you, sold to nobody.
A car that phones home is fine. A car that phones someone else’s business model, on your petrol, is the thing worth objecting to — and the first step is knowing the call is being made at all.