Automakers are increasingly under fire for collecting and selling driver behavior data to third-party brokers, prompting regulatory interest and calls for stricter privacy controls.

The Federal Trade Commission recently imposed a five-year ban on General Motors, prohibiting the company from selling customer data to third-party brokers and consumer reporting agencies. This action followed reports that GM collected driving behavior data—such as speeding and nighttime driving—through its OnStar connected services and shared it with companies like LexisNexis and Verisk. Many drivers were unaware their data was being sold, which some reported led to increased insurance premiums.

Industry-Wide Data Collection

Research by the Mozilla Foundation in 2023 concluded that major car companies maintain poor privacy and security standards. According to the study, customers are often forced to accept multiple, overlapping data collection policies covering the vehicle, connected services, smartphone apps, and financial services. Consumer Reports also found that nearly every automaker selling cars in the U.S. collects and shares driver behavior data. Unlike smartphones, where privacy settings are relatively centralized, vehicle data collection is fragmented across various systems. This complexity makes it difficult for consumers to understand or manage what information is being gathered, leading to concerns that automakers are operating with minimal public oversight.

Legislative and Policy Responses

In December, a group of House Republicans introduced the Data Rights for Information and Vehicle Electronics (DRIVER) Act, which aims to grant vehicle owners ownership of the data their cars generate. However, critics argue the bill is insufficient because it would still allow automakers to collect and sell data, placing the burden on consumers to request data deletion through complex processes. Separately, Transportation Secretary Sean Duffy proposed the concept of a "Freedom Car" in a letter to Congress, advocating for the right to drive vehicles that are disconnected and non-automated. The proposal seeks to prevent government mandates requiring wireless data transmission or automated driving systems. Despite these efforts, it remains unclear if these legislative concepts will advance.