Fifteen Million Rows of You: Inside the Quiet Market for Connected-Car Data

Your car knows more about you than your closest friends. It knows where you sleep, where you worship, how hard you brake on the way to work, and — in some models — it can hear you. What most American drivers do not realize is that a meaningful share of this information does not stay in the vehicle. It travels, gets packaged, and gets sold.

A Computer That Happens to Have Wheels

The average new vehicle sold in the United States today ships with more lines of software code than the systems that once guided commercial aircraft. Cellular modems come standard, streaming telematics data back to manufacturers continuously. Every trip becomes a record: timestamps, GPS coordinates, speed, acceleration, cornering force, seatbelt status, and sometimes video or audio captured by in-cabin sensors.

This is not a fringe concern. In 2023, a class action filed in Washington state alleged that Honda's in-cabin cameras and microphones collected far more than drivers expected. General Motors drew federal scrutiny after reporting was revealed showing it shared driving-behavior data with analytics firms that sold scores to insurers. The pattern is industry-wide: what happens in your car does not stay in your car.

Mapping the Supply Chain

The connected-car data economy works less like a single transaction and more like a river with many tributaries.

At the source sits the automaker, which owns the telematics platform and writes the terms of service — often dozens of pages long, with privacy practices that differ between brands and even between model years. Downstream flow the data brokers and analytics companies. Firms such as Verisk and LexisNexis Risk Solutions have historically received driving data from manufacturers, converted it into risk scores, and supplied those scores to auto insurers. In GM's case, the company later said it stopped sharing driving behavior with the two analytics firms after the reporting and backlash.

From there, the data can reach insurers adjusting premiums, marketers profiling households, and — through legal process — law enforcement, which increasingly requests vehicle telematics records in criminal investigations. Each handoff is technically disclosed somewhere in a policy almost nobody reads.

The Worst Offenders

Privacy watchdogs have tried to grade the industry. The Mozilla Foundation's Privacy Not Included project reviewed 25 major brands in 2023 and concluded that every single one failed its minimum privacy standards — the worst result the group had recorded for any product category. Among the findings:

• Nissan and Kia privacy policies disclosed collection of in-cabin audio and video in certain contexts.
• Volkswagen and Toyota policies described collecting driving habits and connected-service data with broad sharing language.
• Tesla came under regulatory investigation after reports that staff internally circulated sensitive footage recorded by customer vehicles, including clips of near-collisions and private property.

The policies themselves are the tell. Buried in dense legal language, several automakers reserve the right to share "de-identified" data — a term that researchers repeatedly show is reversible when datasets are rich enough. A location trail ending at your driveway every night identifies you no matter what the disclaimer says.

What Drivers Can Actually Do

The good news is that the levers exist. The bad news is that they are deliberately inconvenient. Here is a practical checklist:

1. Read the connected-services terms before activating anything. Many telematics features require enrollment. Declining enrollment for services you don't use — remote start, usage-based insurance apps — can keep data collection limited from day one.
2. Check for existing enrollment. If you bought a used car, the previous owner's consent may have carried over. Call the manufacturer's connected-services line and ask what data plan the VIN is enrolled in, and request deletion or deactivation.
3. Exercise your deletion rights. Residents of California, Virginia, Colorado, and other states with comprehensive privacy laws can request access to and deletion of collected personal data. Automakers maintain privacy request portals; use them.
4. Disconnect what you can. Some vehicles allow the cellular modem to be disabled, though manufacturers warn this can disable emergency features like automatic crash notification. Weigh that tradeoff honestly.
5. Watch the insurance pitch. Discounts for "safe driving" programs almost always mean continuous behavior monitoring. The discount is real; so is the surveillance.
6. File complaints when appropriate. The FTC has shown renewed interest in vehicle privacy, and state attorneys general have taken action. Complaints create the record that drives enforcement.

A Market With No Speed Bump

Automakers argue that vehicle data improves safety, enables over-the-air repairs, and funds free services. That argument has merit — collision data has saved lives, and remote diagnostics catch problems before stranded motorists do. But safety and monetization are separate choices, and the industry has consistently bundled them, treating driver consent as a formality rather than a decision.

Legislation may eventually change the math. The American Privacy Rights Act proposals and various state bills have specifically flagged connected-vehicle data. Until then, the burden falls on drivers to do what the dashboard will not: close the spigot themselves.

Your car was designed to protect you in a crash. Protecting you from the data brokers, for now, remains your job.