Your Car Knows About You.
Connected vehicles can collect information about you, and some of that information can move beyond the automaker to service providers or other companies. Opting out is not always easy, and shutting down certain data flows can also disable connected features you paid for.
Your Car Is Now A Connected Device
Modern cars increasingly contain cellular connections that can transmit information without a phone being plugged in. Ford says connected vehicles can send vehicle data, driving data, location information, and analytics tied to a VIN or other identifiers. Toyota similarly says its connected vehicles can transmit location, acceleration, braking, speed, sensor readings, and vehicle-health information.
Driving Data Can Get Surprisingly Detailed
“Driving data” can mean much more than total mileage. Toyota lists acceleration, speed, steering, braking, direction of travel, and other vehicle-operation information, while GM describes driver-behavior information including speed, seatbelt use, braking, acceleration, and trip duration. Those individual data points can create a surprisingly detailed picture when collected over time.
Location Is Particularly Sensitive
A connected vehicle can potentially reveal where it spends nights, where it travels each morning, and which places it visits repeatedly. The FTC has emphasized that precise geolocation is particularly sensitive because location patterns can reveal intimate details of a person's life. A car can therefore function much like a continuously moving connected device.
“Third Party” Can Mean Several Things
Not every outside company receiving vehicle information is a data broker or insurer. Automakers commonly use cloud-hosting companies, cellular providers, telematics vendors, navigation suppliers, and other contractors to operate connected services. Those service providers may process information on the automaker's behalf without having the same independent rights to use it.
Independent Uses Are A Bigger Privacy Question
The privacy issue changes when data is provided to another company for that company's own purposes. Toyota currently says it will not provide vehicle location or driving data to other parties for their own purposes without the driver's consent. GM also distinguishes companies working on its behalf from third parties receiving data for their own services.
The GM Case Showed What Could Go Wrong
In 2025, the Federal Trade Commission accused General Motors and OnStar of inadequately informing consumers before collecting and selling precise location and driver-behavior data. The FTC said the information came from millions of vehicles through GM's connected services and Smart Driver program. The agency described it as its first enforcement action involving connected-vehicle data.
Insurance Was Part Of The Controversy
The FTC said GM had provided driver-behavior information to consumer reporting agencies, and that such information could be used in insurance pricing. The Consumer Financial Protection Bureau confirms that LexisNexis Telematics OnDemand collects and reports driving-behavior information for auto-insurance pricing. That turns vehicle telemetry from an abstract privacy issue into something with possible financial consequences.
GM Ended The Relationships
GM announced in 2024 that it had terminated its relationships with telematics companies LexisNexis and Verisk. It also discontinued the Smart Driver program and said customers would be unenrolled. GM said those third-party data-sharing relationships ended in March 2024.
Federal Regulators Went Further In 2026
The FTC finalized its GM and OnStar order in January 2026. GM is prohibited for five years from disclosing covered geolocation and driver-behavior data to consumer reporting agencies. The order also imposes broader privacy requirements lasting 20 years.
GM Owners Now Get Significant Choices
Under the FTC order, GM must generally obtain affirmative express consent before collecting, using, or sharing covered connected-vehicle information, subject to limited exceptions. It must also provide U.S. consumers a way to opt out of collection of geolocation and driver-behavior data. Consumers can request copies of their information and seek deletion as well.
That Rule Does Not Automatically Cover Every Brand
The FTC order applies to GM and OnStar because it resolves that particular enforcement case. It did not create a single nationwide dashboard button every automaker must use. Your available choices still depend on the brand, connected service, information involved, and applicable privacy law.
Toyota Gives Owners A Data Portal
Toyota's current Connected Services Privacy Notice points owners to a Data Privacy Portal within the Toyota app. Drivers can review what their vehicle is transmitting and adjust vehicle data preferences. Toyota also operates a broader Privacy Hub where consumers can submit access, deletion, correction, and applicable opt-out requests.
Toyota Lets You Disable Transmission
Toyota says owners can opt out of Connected Services or request deactivation of vehicle data transmission. According to its current policy, that can stop collection of certain location, driving, vehicle-health, and account information. It is a meaningful option, although it comes with a trade-off.
The Trade-Off Can Be Losing Connected Features
Toyota states that declining its Vehicle Connectivity Consent shuts off data transmission and eliminates access to Connected Services. Features such as remote access, connected navigation, safety services, and maintenance information can depend on that connection. Privacy controls can therefore become a choice between less data collection and fewer connected conveniences.
Ford Also Provides Vehicle-Level Controls
Ford says the data a connected vehicle transmits depends partly on its equipment, software, connected services, and selected data-sharing settings. Ford directs owners to in-vehicle settings and the owner's manual for information about deactivating connectivity. Some models also display icons indicating that vehicle, driving, or location data is being shared.
Deleting The Ford App Is Not Enough
Ford explicitly warns that deleting the Ford app from a phone does not necessarily stop connected-vehicle data sharing. To stop account-associated remote access and certain connected information, Ford says owners may need to remove the VIN from all associated accounts or perform a factory reset. That distinction is easy to miss.
Honda Also Acknowledges Vehicle Data Choices
Honda owner documentation tells drivers that compatible vehicles may share location and usage information. It points owners toward Honda's vehicle-data choices for managing those settings. The existence of those controls reinforces an important lesson: privacy options may live outside the main infotainment menu.
Start With The Car's Privacy Menu
Before filling out legal forms, explore the vehicle itself. Look for settings labeled Privacy, Connected Services, Data Sharing, Location Services, Vehicle Connectivity, Analytics, or similar terms. Modern vehicles increasingly provide at least some control directly through the infotainment system.
Then Check The Automaker Account
Some choices are managed through the manufacturer's website or smartphone application rather than inside the vehicle. GM provides privacy controls through its account system, Toyota uses its app and Privacy Hub, and Ford links connectivity to vehicle and account settings. Reviewing both locations reduces the chance that one data stream remains active unintentionally.
https://kaboompics.com/, Pexels
“Do Not Sell” Does Not Mean “Collect Nothing”
This is an important distinction. A legal request to stop the sale or sharing of personal information does not necessarily require a company to stop collecting information it legitimately needs to provide a requested service. Likewise, disconnecting targeted advertising does not automatically disable vehicle diagnostics or emergency connectivity.
Service Providers May Still Receive Information
Even a strong privacy opt-out can allow data to flow to contractors needed to deliver the service. Toyota lists providers involved in areas such as cloud hosting, voice technology, telematics, and subscription management. GM similarly describes service providers that process data on its behalf without an independent right to use certain information.
Safety Exceptions Can Remain Active
Some connectivity may continue when safety is involved. GM says certain vehicles may still transmit geolocation or vehicle information during emergencies even when ordinary location services are disabled. Toyota also describes information sharing with emergency responders when necessary to provide connected safety services.
Legal Obligations Create Exceptions Too
Companies may be required to preserve or disclose information for recalls, regulatory requirements, legal process, fraud investigations, or other legally permitted purposes. California's privacy regulator likewise lists legal compliance and certain product or service requirements among situations where deletion requests can be denied. Opting out therefore does not mean a company must erase every record under every circumstance.
State Privacy Laws Can Give You More Leverage
The United States still lacks a single comprehensive federal consumer privacy law governing all connected-vehicle data. Instead, state privacy laws increasingly provide access, deletion, correction, and opt-out rights. Exactly which rights apply depends on where you live and whether the company falls within that state's law.
California Has Broad Opt-Out Rights
California residents can generally tell covered businesses to stop selling or sharing personal information within the meaning of the CCPA. Precise geolocation is also treated as sensitive personal information. The California Privacy Protection Agency says consumers can request access, deletion, correction, limits on certain sensitive-data uses, and opt-outs from covered sale or sharing.
Colorado And Connecticut Offer Opt-Outs Too
Colorado gives consumers rights to opt out of covered sales of personal data and targeted advertising. Connecticut similarly requires covered controllers to give consumers a way to opt out of covered data sales and targeted advertising. Both states recognize opt-out preference signals such as Global Privacy Control for qualifying online activities.
Browser Privacy Signals Have Limits In Your Car
Global Privacy Control is useful, but it primarily sends a privacy preference through a browser or compatible online platform. GM, for example, says it honors GPC on its websites at the browser level. Turning it on does not by itself tell the cellular modem inside your vehicle to stop transmitting driving information.
Ask For A Copy Before You Delete
One useful strategy is to exercise an access right before requesting deletion. GM now gives consumers covered by its privacy statement access and portability rights, while Toyota provides a right-to-know process through its Privacy Hub. Seeing the information can help you understand what was actually collected rather than relying on assumptions.
Ask Who Received The Information
Some privacy laws and corporate programs let consumers request information about categories of third parties receiving their data. GM's current privacy statement includes additional third-party information rights in jurisdictions where applicable. If an unfamiliar company's name appears, look up its privacy policy and determine whether it provides its own deletion, access, or opt-out procedure.
Check Your Insurance Consumer Report
If you are worried that driving information reached an insurance-related consumer reporting company, the CFPB provides a practical route. It says LexisNexis C.L.U.E. and Telematics OnDemand will provide consumers a free report every 12 months upon request. Reviewing that report can reveal information being used in insurance underwriting and give you an opportunity to dispute inaccuracies.
A Report Freeze Is Another Tool
The CFPB also says consumers can request a freeze of their LexisNexis consumer report. A freeze is different from turning off the vehicle's telemetry and can affect legitimate insurance-related access, so understand the consequences before using it. Still, it gives consumers an additional measure of control once information has reached the reporting ecosystem.
California Added A Data-Broker Delete Button
California's new Delete Request and Opt-Out Platform, called DROP, began accepting consumer deletion requests in 2026. Beginning August 1, registered data brokers must periodically retrieve and process qualifying deletion requests submitted through the platform. The system allows a California resident to make one request aimed at many registered data brokers rather than contacting each individually.
https://kaboompics.com/, Pexels
Opting Out Is Possible, But It Takes Some Work
Yes, many owners can limit at least some connected-car collection or third-party sharing, but there is no universal switch covering every automaker, state, and category of data. Start with the vehicle's privacy settings, then the manufacturer's app and privacy portal, submit any legal opt-out or access requests available in your state, and check outside consumer-reporting companies if necessary. The uncomfortable reality is that today's car is both a vehicle and a connected computer, so protecting your driving data now deserves the same attention as protecting information on your phone.
You May Also Like:
The Five Most Stolen Cars In North America
Minivans That Are Actually Cool
Sources: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17
