Connected Car Data Privacy Explained: What Cars Collect and Who Gets It

A connected car collects where it goes, how it is driven, what you say to its voice assistant and whatever your phone hands it when you pair, and it sends much of that to the manufacturer through a built-in cellular modem. The manufacturer can pass it on to service providers, dealers, insurers and, as a federal regulator alleged in one case, consumer reporting agencies. You can limit it: turn off optional connected services and location sharing, file access and deletion requests, check insurance-related consumer reports, and wipe the car before you sell or return it.

This post goes one level deeper than our look at connected car security myths versus facts and the telematics control unit attack surface. Those posts deal with attackers. This one deals with the data the car collects on purpose, who receives it, what regulators have said and ordered, and the settings and requests that reduce what leaves your car. Claims about named companies come from regulators' published actions or the companies' own notices, and allegations are labelled as allegations.

Key takeaways

• Four parts do most of the collecting: the telematics control unit (the car's cellular modem), the infotainment head unit, the companion app and, in a crash, the event data recorder. The data that matters most is precise location, driving behaviour, voice and camera data, and what your phone syncs to the head unit.
• In May 2024 FTC staff wrote that geolocation from cars is sensitive and that "surreptitious disclosure of sensitive information can be an unfair practice."
• In January 2025 the FTC announced a proposed order against General Motors and OnStar over allegations that driving and location data were collected and sold without consent. The FTC finalized the order on 14 January 2026, with a five year ban on disclosing that data to consumer reporting agencies and a 20 year consent requirement.
• California's privacy agency opened a review of connected vehicle makers on 31 July 2023. In March 2025 its Board issued a decision requiring American Honda Motor Co. to change how it handles privacy requests and pay a $632,500 fine to resolve the agency's claims.
• In the EU, the EDPB treats the connected car as "terminal equipment", which brings the ePrivacy consent rule into play, and singles out location, biometric data and data revealing offences for special care.
• Under the US Driver Privacy Act of 2015, event data recorder data belongs to the owner or lessee, and others may access it only in five listed situations.
• Quick wins: delete your phone from rental cars, turn off optional data sharing, and reset the car and remove it from your account before you sell.

What data does a modern car collect?

Almost everything a modern car records is personal data once it can be linked to a driver, an owner or a VIN. The European Data Protection Board's Guidelines 01/2020 say most connected vehicle data is personal "to the extent that it is possible to link it to one or more identifiable individuals", including technical data such as speed, distance travelled and tyre pressure. The useful question is which part collects it, where it goes, and whether you can switch it off.

The parts that do the collecting

The telematics control unit (TCU). The car's own cellular modem and the main route out of the vehicle. It carries emergency calls, remote unlock and start, stolen vehicle location, over-the-air updates and the telematics the manufacturer uses for diagnostics and connected services. It has its own SIM, so it works whether or not your phone is in the car.

The infotainment head unit. The screen in the dashboard runs navigation, media, the voice assistant and phone integration. It stores navigation history, saved addresses, paired phone records and, on many models, synced contacts and call logs. On some cars it also hosts third party apps that have their own privacy terms.

The companion app. The manufacturer's phone app talks to the manufacturer's cloud, which talks to the car through the TCU, and adds its own data: your phone's location, your account and app analytics.

The event data recorder (EDR). A crash recorder that keeps a short window of vehicle dynamics around a crash, covered in its own section below.

Cameras and sensors. Driver monitoring cameras for hands-free driver assistance, exterior cameras for parking and lane keeping, and interior microphones for calls and voice commands. Whether their output ever leaves the car depends on the manufacturer and the feature.

Location

Location is the data point regulators worry about most. The EDPB explains why: journeys "enable one to infer the place of work and of residence" and can reveal religion through places of worship or sexual orientation through places visited. FTC staff made the same point in their May 2024 post on cars and consumer data, noting that cars reveal persistent, precise location much as phones do and that "geolocation data is sensitive and subject to enhanced protections under the FTC Act."

Frequency matters as much as collection. In January 2025 the FTC alleged that precise geolocation for some OnStar users was collected "sometimes as often as every three seconds."

Driving behaviour

Driving behaviour is the data that feeds insurance pricing: speed, hard braking, rapid acceleration, time of day and trip length. GM's current US privacy statement, last updated 17 June 2026, defines Driver Behavior Information as information about how you drive "such as vehicle speed, seatbelt use information, information about braking and acceleration habits, and related trip time and duration." The FTC's 2025 complaint announcement alleged that GM's Smart Driver feature collected "every instance of hard braking, late-night driving, and speeding."

Cabin cameras and microphones

Cars with hands-free driving assistance use an interior camera to check that the driver is watching the road. Whether images leave the car is a policy choice, so read the notice for your make. GM's statement, for example, says it does not collect camera images or video from interior sensors such as the Super Cruise driver monitoring system, but "may collect data other than images or video that is derived from these sensors," such as when the car detects a distracted or drowsy driver. That is a meaningful distinction: no pictures, but a record of the inference.

Voice assistant audio

Voice commands are processed in the car or in the cloud. GM's statement lists "recordings of your voice when you use voice commands" among the audio it may collect, plus a separate category for AI assistant interactions. If your car has a cloud voice assistant, assume requests are recorded unless the notice says otherwise.

Synced phone data

When you pair a phone over Bluetooth, the head unit typically asks to sync your contacts and call history, and some systems also pull text messages for read-aloud features. That data is stored in the car, not just streamed through it. The FTC's consumer advice on renting a car warns that infotainment systems may keep GPS destinations, your phone number, call and message logs, and contacts or texts after you return the car.

Vehicle health and exterior sensors

Vehicle status data includes mileage, battery or oil level, door and window state, diagnostic trouble codes, tyre pressure and, for electric vehicles, charging and discharging details. GM's statement lists all of these as Vehicle Information it can link to you through the VIN or licence plate. Newer cars add exterior camera and sensor data: GM says that for model year 2025 and newer vehicles it may ask for consent to collect "video and measurements (not audio)" from built-in external cameras and sensors.

What each part collects, at a glance

Who receives connected car data?

Once data leaves the car, the recipients are set by the manufacturer's notice, the terms of each service you accept and the law where you live. The EDPB names the usual chain: manufacturers, dealerships, service providers, fleet managers, motor insurers, repairers and public authorities.

The manufacturer and its connected services company

The manufacturer, or a connected services subsidiary it owns, is the first recipient of almost everything the TCU sends. GM's statement explains that when a car is enrolled in OnStar, GM and its affiliates may use Driver Behavior Information and Precise Geolocation Information for listed purposes, including vehicle locate features, turn-by-turn routing, stolen vehicle recovery, safety, warranty, product development and security.

Service providers, dealers, fleet owners and rental companies

Manufacturers use processors for hosting, analytics and support, and dealers receive service data. GM's statement lists "fleet owners, dealers, or rental car companies, for service or maintenance of their vehicles that you may use" among the parties that can receive driver behaviour and location data. If you drive a rental, a company car or a car on a subscription, the owner of that vehicle may see data about your trips.

Insurers and usage-based insurance

Usage-based insurance prices cover on how you drive. The data can come from an insurer's own plug-in device or phone app, from the manufacturer with your consent, or from a third party. GM's statement now says it shares driver behaviour or precise location data with General Motors Insurance "when you have given your affirmative consent" for usage-based insurance offers or quotes. The EDPB's case study on usage-based insurance recommends that insurers receive scores rather than raw driving data, and that "if only the mileage is necessary for the performance of the contract, location data shall not be collected."

Consumer reporting agencies and data brokers

This is the part that drew enforcement. The Consumer Financial Protection Bureau's list of consumer reporting companies notes that some companies in the insurance category may share driving behaviour data, collected from a phone or vehicle using GPS telematics, with auto insurers who use it to set prices at quote or renewal. When driving data reaches one of these companies, it can follow you to every insurer that buys a report, not just the one you chose to share with.

Emergency services and law enforcement

Emergency call systems send location to first responders by design, and the FTC's GM order keeps an exception for it. Event data recorder access by others, including police, follows the rules described below.

What did US regulators find and order?

Three kinds of public documents shape the US picture: FTC staff guidance, FTC orders and state actions. A complaint contains allegations; an order contains obligations; neither is a court finding of fact.

The FTC's May 2024 guidance on cars and consumer data

On 14 May 2024, staff in the FTC's Office of Technology and Division of Privacy and Identity Protection published "Cars & Consumer Data: On Unlawful Collection & Use". It says connected cars can gather biometric information, precise location, telematic data, video and other personal information, and it makes three points:

1. Geolocation is sensitive. The FTC has treated collection, use and disclosure of location as potentially unfair, and car location is as revealing as phone location.
2. Surreptitious disclosure can be unfair. A company with legitimate access to sensitive data must use it only for the purposes it was collected for.
3. Automated decisions using sensitive data can be unlawful. Feeding consumer data into algorithms can create liability for the harmful decisions that follow.

It is staff guidance, not a rule, but it told the industry how the FTC Act would be applied.

The FTC's General Motors and OnStar order

On 16 January 2025 the FTC announced a proposed consent order with General Motors and OnStar. According to the FTC's announcement, the complaint alleged that the companies collected, used and sold drivers' precise geolocation and driving behaviour data from millions of vehicles without adequately notifying consumers or obtaining their affirmative consent; that the enrollment process for OnStar and Smart Driver was "confusing and misleading"; and that data was sold to third parties including consumer reporting agencies, whose reports insurers used in coverage and pricing decisions. The Commission voted 3-0-2 to accept the proposed order for public comment.

On 14 January 2026 the FTC announced that it had finalized the order, by a 2-0 vote. The final press release describes the matter as settling allegations, and the companies named are General Motors LLC, General Motors Holdings LLC and OnStar, LLC. The order's terms, as the FTC describes them:

If you own a GM vehicle, the access, deletion and opt-out routes the order requires are tools you can use now. The order binds one company; it shows how the FTC reads the law, but other manufacturers are bound only by the law and their own promises.

State actions: Texas

On 13 August 2024 the Texas Attorney General announced a lawsuit against General Motors. The Attorney General's release alleges that GM collected detailed driving data from most 2015 model year and newer GM vehicles, sold it to other companies including at least two that generated "Driving Scores" for insurers, and told customers during onboarding that declining to enroll would deactivate safety features. The release says the suit covers data on over 1.5 million Texans. These are the state's allegations; we could not confirm the outcome of the case from the Attorney General's site, so check it before relying on any status.

On 13 January 2025 the same office announced a suit against Allstate and its subsidiary Arity under the Texas Data Privacy and Security Act. The state alleges that the companies paid app developers to embed software that collected location and movement data from phones, gathered data on over 45 million consumers nationwide, and used it in insurance pricing without notice or consent. The release calls it the first enforcement action filed by a state attorney general under a comprehensive data privacy law. It matters because driving data does not only come from the car: a phone app with location access can produce the same profile.

The Commerce Department's connected vehicle rule

A different federal action addresses who may build the parts that collect the data. On 16 January 2025 the Bureau of Industry and Security published a final rule, effective 17 March 2025, on information and communications technology integral to connected vehicles that is designed, developed, manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of certain foreign adversaries. Its focus is national security risk to US persons rather than consumer consent, and it gives drivers no new privacy rights, but it does reach the connectivity hardware and software through which vehicle data leaves the car.

Timeline

California: the CPPA's connected vehicle review and your CCPA rights

What the 2023 review covered

On 31 July 2023 the California Privacy Protection Agency's Enforcement Division announced a review of data privacy practices by connected vehicle manufacturers and related connected vehicle technologies. The announcement named the features in scope: location sharing, web-based entertainment, smartphone integration and cameras. The agency's then Executive Director described modern vehicles as "effectively connected computers on wheels" able to monitor people both inside and near the vehicle, and the announcement noted that California has more than 35 million registered vehicles. The review was run under the California Consumer Privacy Act.

The announcement did not publish findings. Its first public result came on 12 March 2025, when the CPPA Board issued a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine to resolve claims that it violated the CCPA. The agency says the investigation arose from the connected vehicle review. Its Enforcement Division alleged four problems, all about the mechanics of exercising rights rather than what the car collected:

• requiring consumers to verify themselves and provide excessive personal information to exercise rights such as opting out of sale or sharing and limiting use of sensitive data;
• an online privacy tool that did not offer choices in a symmetrical or equal way;
• making it hard to use an authorized agent;
• sharing personal information with ad tech companies without producing contracts containing the required privacy terms.

Honda agreed to a simpler request process, compliance certification, staff training, a review of its request flows by a user experience designer and changes to its contracting. The CPPA noted that fines apply per violation, up to $2,500 each or $7,500 for intentional violations, adjusted for inflation.

How CCPA rights apply to a car

The California Attorney General's CCPA page lists the rights that apply to any business covered by the law, which includes manufacturers, connected services companies, insurers and data brokers that meet the thresholds. Applied to a car:

Businesses must respond to a request to know within 45 calendar days and can extend by another 45 days with notice. Only California residents have CCPA rights. Other states have their own privacy laws, Texas among them, so check the manufacturer's notice for the process that applies where you live.

For data that has already reached data brokers, California's Delete Request and Opt-out Platform lets residents send one deletion request to over 600 registered brokers. The platform launched on 1 January 2026, brokers began processing requests on 1 August 2026, and the state says brokers must check the platform at least once every 45 days.

What does EU law require for connected vehicles?

GDPR and the EDPB's Guidelines 01/2020

In the EU and EEA, vehicle data that can be linked to a person is governed by the General Data Protection Regulation. The EDPB's Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications, version 2.0 adopted on 9 March 2021, set out how the GDPR applies. The main points:

• Three categories need special attention: location data; biometric data and any special category data under Article 9 GDPR; and data that could reveal criminal offences or traffic violations.
• Location rules: collect location only when absolutely necessary (the EDPB notes that a gyroscope is enough to detect movement), configure frequency and precision to the purpose ("a weather application should not be able to access the vehicle's location every second, even with the consent of the data subject"), activate location only when the user starts a feature that needs it and "not by default and continuously when the car is started", show an icon when location is on, allow it to be switched off at any time, and set a limited storage period.
• Biometrics: offer a non-biometric alternative such as a key or code, and store and compare templates only locally, in encrypted form.
• Offence data: process data revealing infractions locally where the person has full control; external processing is in most cases forbidden.
• Local processing first: where possible, keep processing inside the vehicle. Where that is not possible, use "hybrid processing", for example computing an insurance score in the car or at a telematics provider so the insurer never sees raw driving data.
• Privacy by default: data subjects should be able to activate or deactivate processing, and the EDPB recommends "a simple functionality (such as a delete button)" to clear navigation history, browsing and similar data from the dashboard.
• Change of ownership: selling a connected vehicle should trigger deletion of personal data no longer needed, and owners should be able to "delete permanently any personal data before the vehicles are put up for sale."

Why the ePrivacy rule applies to cars

The ePrivacy Directive's Article 5(3) requires consent before storing information on, or reading information from, a user's "terminal equipment", subject to narrow exceptions. The EDPB's view is that the connected vehicle and devices connected to it should be considered terminal equipment, "just like a computer, a smartphone or a smart TV". The consequence is that a manufacturer or service provider that reads data out of the car generally needs prior consent, unless the access is strictly necessary to provide a service the user explicitly requested. The EDPB gives GPS navigation requested by the driver as an example of processing that falls under the exception. The ePrivacy consent then shapes the GDPR legal basis for what happens next: in most cases, consent will also be the most adequate basis for the subsequent processing.

The guidelines also note that 112-based eCall has been mandatory in all new types of M1 and N1 vehicles (passenger cars and light duty vehicles) since 31 March 2018. eCall is a legal obligation with its own rules, which is one reason an EU car can still send its location to emergency services after a serious crash with every optional connected service switched off.

How UN Regulations 155 and 156 relate to data protection

UN Regulation No. 155 (cyber security) and No. 156 (software updates) both entered into force on 22 January 2021 as annexes to the 1958 Agreement. They are type approval rules, covered in our WP.29 explainer. For privacy, three points matter:

• R155 says it is "without prejudice" to national and regional legislation on privacy and the protection of personal data. It does not replace the GDPR or any US law and gives drivers no privacy rights of its own.
• R155's threat catalogue includes unauthorised access to the owner's privacy, and lists "information breach" when the car "changes user (e.g. is sold or is used as hire vehicle with new hirers)" with a mitigation that best practices for data integrity and confidentiality be followed for storing personal data.
• R156 governs how software updates are delivered and recorded. It concerns update integrity, not personal data.

The UN rules make manufacturers protect stored personal data from attackers; privacy law decides what they may collect and share.

Event data recorders: what they store and who may read them

What 49 CFR Part 563 requires

An event data recorder is defined in 49 CFR 563.5 as a device or function that records "the vehicle's dynamic time-series data during the time period just prior to a crash event... or during a crash event," intended for retrieval afterwards. The definition states that event data do not include audio and video. Part 563 does not require cars to have an EDR. It applies to passenger cars, multipurpose passenger vehicles, trucks and buses with a gross vehicle weight rating of 3,855 kg (8,500 pounds) or less, manufactured on or after 1 September 2012, that are equipped with one.

A recording is triggered by an "event": a crash or other occurrence that meets the trigger threshold, defined as a change in longitudinal velocity of 8 km/h or more within 150 ms, or the deployment of a non-reversible restraint such as an airbag. Required data elements include:

The current eCFR text extends the pre-crash window: Table I specifies speed, accelerator and brake from 20 seconds before the crash at 10 samples per second. A footnote keeps the older 5 seconds at 2 samples per second for vehicles built before 1 September 2031, with 25, 50 and 75 percent of each manufacturer's EDR-equipped production moving to the longer window in the years starting 1 September 2028, 2029 and 2030.

Part 563.11 also requires a standard paragraph in the owner's manual. It says the EDR records data in non-trivial crash situations, that "no data are recorded by the EDR under normal driving conditions", and that no personal data such as name, gender, age or crash location are recorded. It adds the important caveat that other parties, such as law enforcement, could combine EDR data with personally identifying data routinely collected during a crash investigation, and that reading the data requires special equipment and access to the vehicle.

Who may access EDR data: the Driver Privacy Act of 2015

Section 24302 of the FAST Act, approved on 4 December 2015 and known as the Driver Privacy Act of 2015, settles ownership: data retained by an EDR "is the property of the owner, or, in the case of a leased vehicle, the lessee," regardless of when the car was made. Anyone else may access it only if one of five conditions applies:

1. A court or other judicial or administrative authority authorises retrieval, and the data meets that body's evidence standards.
2. The owner or lessee consents in writing, electronically or by recorded audio, including for diagnosis, service or repair, or by agreeing to a subscription that describes how data will be retrieved and used.
3. The retrieval is part of an investigation or inspection authorised under 49 U.S.C. 1131(a) or 30166, with the owner's personal information and VIN not disclosed (except the VIN to the certifying manufacturer).
4. The data is retrieved to determine the need for, or to facilitate, emergency medical response after a crash.
5. The data is retrieved for traffic safety research, with personal information and VIN not disclosed.

Note condition 2. Agreeing to a connected service subscription that describes EDR retrieval counts as consent, which is one more reason to read what you accept when you activate a new car. Note also what the Act does not cover: it governs EDR data, not the far richer telematics stream the TCU sends every day.

What leaks when you pair a phone with a rental or used car?

Pairing a phone hands the head unit a copy of more than you might expect, and that copy stays when you leave. Based on the FTC's consumer guidance for renters and sellers, and on what manufacturers say in their own notices, the leftovers fall into a few groups:

• Identity: your phone's Bluetooth name (often your first name), phone number and the record of the pairing itself.
• Contacts and communications: synced contacts, call history and, on systems with read-aloud, text messages.
• Places: home and work addresses saved in navigation, recent destinations, and routes.
• Accounts: logins for streaming and other apps installed on the head unit, and for some cars a linked manufacturer account.
• Access: garage door opener codes programmed into the car.
• Content: music or other files saved to the car's storage.

GM's privacy statement says plainly that if you do not delete personal information such as contacts, address searches, saved map addresses or preferences when you sell or transfer a vehicle, "it may remain in the vehicle and may be accessible to future users of the vehicle." The FTC's consumer alert on selling a car adds that a factory reset may not finish the job, and lists cancelling subscriptions such as satellite radio and mobile hotspots and disconnecting the manufacturer app as separate steps.

For rentals, the FTC suggests charging from a cigarette lighter adapter rather than the USB port, because a USB connection may transfer data automatically, and granting only the permissions a feature needs at the pairing prompt: streaming music does not need your contacts.

Comparison: who collects each type of car data, your rights and your controls

Step by step: limit what your car shares

Exact menus differ by manufacturer and model year, so use your owner's manual and the manufacturer's privacy notice alongside these steps.

Step 1: Inventory the car, the accounts and the apps

Write down the make, model year and VIN; every connected service subscription or trial; every account (manufacturer, connected services, insurer app, streaming apps on the head unit); every phone ever paired, including other drivers'; and every phone app that can see your location while driving.

On Android you can check location permissions for each installed app from a computer with the platform tools installed and USB debugging enabled. This only reads information; it changes nothing.

# List installed packages that look car, insurance or driving related
adb shell pm list packages | grep -iE "car|auto|vehicle|drive|insur|fleet"

# For one package, show which location permissions are granted
adb shell dumpsys package com.example.carapp | grep -E "ACCESS_(FINE|COARSE|BACKGROUND)_LOCATION"

# Show the current app-op mode for background location for that package
adb shell appops get com.example.carapp ACCESS_BACKGROUND_LOCATION

Replace com.example.carapp with the package name from the first command. On an iPhone, open Settings, then Privacy & Security, then Location Services, and review each app's setting; "Always" is the one to question for any app that does not need your location when it is closed.

Step 2: Change the data sharing settings in the car and the app

Start in the car. Most head units have a Privacy or Connectivity menu. GM's statement says some model year 2019 and later vehicles have an option to disable location services for OnStar through Privacy Settings in the infotainment system, and that newer models let you pause exterior camera and sensor data collection there. Look for equivalent settings in your make:

• location services or location sharing;
• data sharing for product improvement or analytics;
• driving score or driving behaviour features;
• camera and sensor data contributions;
• voice assistant cloud processing or voice recording retention.

Then open the manufacturer's account website or app and find its privacy or data settings, which sometimes include choices the car does not show. Turn off what you do not use. Know the trade-offs: switching off location can disable stolen vehicle tracking, remote services and live traffic, and some cars keep emergency location active regardless. GM's statement, for example, says it may still collect location in an emergency, such as a crash, a press of the emergency button or overheating of a high voltage battery, even with location services disabled.

If you want no connected service at all, ask to unenroll. GM's statement says you can disconnect a vehicle and unenroll from OnStar by phone or by pressing the blue button, and notes the exceptions that remain.

Step 3: File access and deletion requests

Ask each company that holds data about your car what it has, then decide what to delete. Use the company's own request form where it has one, because that is the fastest route and the one the regulator will check. If you need to write, keep it short and specific:

Subject: Privacy request: access and deletion of connected vehicle data

I am the owner of a [model year, make, model], VIN [VIN].
Under [the California Consumer Privacy Act / the GDPR / applicable state law], please:

1. Tell me the categories and specific pieces of personal information you hold
   about me or linked to this VIN, including location history, driving behaviour
   data, voice recordings and any scores derived from them.
2. Tell me the categories of third parties to which you sold, shared or disclosed
   that information in the last 12 months, including insurers, consumer reporting
   agencies and data brokers.
3. After providing the above, delete the personal information you collected from
   me, except where you are required to keep it.
4. Stop selling or sharing my personal information, and limit use of my precise
   geolocation to what is necessary to provide services I request.

Please confirm receipt and the date by which you will respond.

Under the CCPA, expect a response within 45 calendar days, extendable once by 45 days. Keep copies of everything. If you are in California and believe data has reached data brokers, add a request through DROP.

Step 4: Check insurer and consumer reporting disclosures

Driving data that has left the manufacturer may sit in a consumer report. The CFPB's list of consumer reporting companies includes an insurance category and notes that some companies may share telematics driving data with auto insurers; its advice is to "fact-check your specialty insurance report when applying for or renewing insurance." Request your file from the insurance-related consumer reporting companies on that list, read it for any driving behaviour entries, and dispute anything wrong with the company that reported it.

Then check whether you enrolled in a usage-based programme, an app based discount or a manufacturer's insurance offer. Each has its own data terms and a way to leave, which may revert you to standard pricing.

Step 5: Reset before you sell, trade in or return a car

Warning: a factory reset of the infotainment system erases saved addresses, paired devices, profiles and settings, and on some cars also removes downloaded apps and maps. Before you start, confirm you are in the right vehicle and the right profile (some cars hold several driver profiles), note anything you want to keep, and make sure the car is parked with the ignition in the state your owner's manual specifies.

Then work through this list, which follows the FTC's consumer alert on selling a car and the manufacturer guidance quoted above:

1. Check: confirm the VIN on the dashboard matches the vehicle you are handing over, and that your manufacturer account shows that VIN.
2. Delete your phone from the list of paired devices, in the car, and delete the car from your phone's Bluetooth list.
3. Delete synced contacts, call history and messages if the system keeps them separately.
4. Delete saved navigation addresses, home and work locations and recent destinations.
5. Sign out of every app and streaming account on the head unit.
6. Clear garage door opener codes using the procedure in your manual.
7. Run the factory reset, then check that the items above are actually gone.
8. In the manufacturer's app or website, remove the vehicle from your account, or transfer it, and cancel connected service, hotspot and satellite radio subscriptions.
9. Remove the car from any insurer app or usage-based programme and remove any plug-in telematics device you installed.

For a rental, steps 2, 4 and 5 are usually enough, and they take two minutes at the return lane.

Step 6: Keep a record

A small tracker helps you follow up on requests and repeat the routine when you change cars.

company,type,request,date_sent,deadline,response,follow_up
Manufacturer,connected services,access+delete+opt-out,2026-10-24,2026-12-08,,
Insurer,usage-based programme,unenrol,2026-10-24,,,
Consumer reporting company,insurance report,file request,2026-10-24,,,
DROP,data brokers,delete,2026-10-24,,,

For teams building connected vehicle software

If you build telematics backends, companion apps or head unit software, the regulators' documents read like a requirements list. Collect location only when a feature needs it, at the lowest workable frequency and precision. Process driving behaviour in the car or at a separate telematics processor and send scores, not raw traces, to anyone who prices risk. Make the consent prompt separate from the terms of sale, make opting out as easy as opting in, and do not ask for more personal information than a request needs, the first of the CPPA's allegations against Honda. Build a real "delete my data" function into the head unit and trigger it on change of ownership. Log every third party that receives vehicle data and keep contracts that limit what they can do with it.

Companion apps and backends are built from open source components, and analytics or advertising SDKs inside them can send data to places your notice does not mention, so knowing which libraries ship in each version is the starting point for an honest notice.

Common mistakes

• Assuming "connected services off" means "no data leaves the car". Emergency call systems and some safety functions keep working, and manufacturers say location may still be collected in an emergency.
• Trusting a factory reset alone. The FTC warns a reset may not remove everything. Check paired devices, addresses and accounts after the reset, and remove the car from your manufacturer account.
• Forgetting the phone side. Insurer apps and other apps with background location can build a driving profile without the car's help, as the Texas complaint against Allstate and Arity alleges.
• Accepting every pairing prompt. Contact and message sync is optional. Calls work without it on most systems.
• Ignoring consumer reports. If your driving data reached a consumer reporting company, it can affect quotes from insurers you never shared data with. Request your file.
• Thinking the EDR records your whole journey. It records a short window around a crash and, per the federal owner's manual statement, nothing under normal driving. The TCU's telematics stream is the bigger privacy question.

FAQ

Does my car track my location all the time?

If it has an active telematics unit and connected services, it can send location whenever those services run. Many cars let you switch off location services in the privacy settings, but emergency location may continue.

Can my car manufacturer sell my driving data to insurers?

It depends on the law where you live and the consent you gave. The FTC's final order bars GM from sharing geolocation and driver behaviour data with consumer reporting agencies for five years and requires affirmative express consent for collection and sharing. California residents can opt out of sale and limit use of precise geolocation under the CCPA.

How do I find out what data my car company has on me?

Use the privacy request form on the manufacturer's website or in its app and ask for access to your personal information and the list of third parties it shared with. In California, businesses must respond within 45 days, extendable by 45 more.

How do I stop my car from sharing data?

Turn off location services and optional data sharing in the car's privacy menu, then in the manufacturer's account. Leave driving score and usage-based insurance programmes you do not want. For no connected service at all, ask to unenroll, accepting that remote features stop working.

What is an event data recorder and who can read it?

A crash recorder that keeps a short window of speed, braking, throttle, seatbelt and airbag data. The data belongs to the owner or lessee, and others need a court order, your consent, a qualifying federal investigation, emergency medical response or anonymised safety research.

What should I delete before selling my car?

Paired phones, synced contacts and messages, saved addresses, app logins, garage door codes and stored media, then run the factory reset, remove the car from your manufacturer account and cancel subscriptions. Check afterwards that the data is gone.

Do GDPR rules apply to connected cars?

Yes. The EDPB says most connected vehicle data is personal data, treats the car as terminal equipment under the ePrivacy Directive so reading data from it generally needs consent, and recommends local processing, minimal location collection and an easy delete function.

Can my insurer get my driving data without a telematics device?

It can if the data reaches it another way, for example from the manufacturer with your consent, from a consumer reporting company that holds telematics data, or from software in a phone app. That is why checking insurance-related consumer reports and app location permissions matters.

Where Safeguard fits

Safeguard does not read your car's settings, file privacy requests, monitor what a vehicle transmits or analyse telematics hardware or firmware, and nothing in the driver advice above depends on it. The fit is indirect and sits with the teams that build connected vehicle software. Companion apps, telematics backends and head unit applications are assembled from open source packages and third party SDKs, and the privacy notice can only be honest if the team knows what is inside each build. Safeguard scans repositories, container images and SBOM files and builds an inventory of the components they contain, shows which projects carry a given component and version, and matches those components against vulnerability databases with reachability analysis. That helps a team answer "which of our apps ship this analytics library" and keep those components patched. It does not tell you whether a given SDK sends location data, which still takes a code and network review.

Fix it without waiting for upstream

A connected car's companion app, its cloud backend and the services that receive its data are ordinary software built on open source dependencies, and when one of those dependencies has a published vulnerability, the data the car sends is only as safe as the patched build. The fit with driver privacy is indirect, but keeping the components in vehicle-facing apps and backends inventoried and patched is part of protecting the data they carry; the fork and patch route described below is early access.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session. It asks the assistant to fix a lodash CVE in a repository, reads the finding and advisory, asks before each command, edits package.json to a fixed version and runs npm install and npm test with approval, pushing nothing. The same flow applies when a scan of a companion app or telematics backend repository shows an outdated library: you ask for the upgrade and approve each step.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with a device code and then scans from the terminal. It suits a team that wants a component inventory of a vehicle app or backend before a privacy review, starting on a developer's own machine.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. It is useful when you want to ask an assistant which of your projects carry a given SDK or library version while you work through the data flow review described above.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard and follow the CLI documentation.

Quick check

Sources

• FTC: Cars & Consumer Data: On Unlawful Collection & Use (14 May 2024)
• FTC: FTC Takes Action Against General Motors for Sharing Drivers' Precise Location and Driving Behavior Data Without Consent (16 January 2025)
• FTC: FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers' Informed Consent (14 January 2026)
• FTC Consumer Advice: Selling your car? Clear your personal data first
• FTC Consumer Advice: Renting a Car
• California Privacy Protection Agency: CPPA to Review Privacy Practices of Connected Vehicles and Related Technologies (31 July 2023)
• California Privacy Protection Agency: Board decision on American Honda Motor Co. (12 March 2025)
• California Attorney General: California Consumer Privacy Act (CCPA)
• CalPrivacy: Delete Request and Opt-out Platform (DROP)
• Texas Attorney General: lawsuit against General Motors (13 August 2024)
• Texas Attorney General: lawsuit against Allstate and Arity (13 January 2025)
• General Motors: U.S. Consumer Privacy Statement (last updated 17 June 2026)
• CFPB: List of consumer reporting companies
• EDPB: Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
• EDPB: Guidelines 01/2020, version 2.0 (PDF)
• eCFR: 49 CFR Part 563, Event Data Recorders
• GovInfo: Public Law 114-94 (FAST Act), section 24302, Driver Privacy Act of 2015
• UNECE: UN Regulation No. 155, cyber security and cyber security management system (PDF)
• UNECE: UN Regulation No. 156, software update and software update management system (PDF)
• Federal Register: Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles, final rule (16 January 2025)

Related reading: connected car security myths versus facts, the telematics control unit attack surface, automotive cybersecurity and UNECE WP.29, GPS and GNSS evolution and location privacy and browser fingerprinting explained.

Last reviewed: 24 October 2026. Privacy notices, orders and state laws change; check the linked documents for the current terms before acting.