A Routine Drive Produces a Detailed Record
The record can begin before the engine starts. A driver unlocks the door, settles into the seat, adjusts the cabin temperature, chooses a song, and presses the ignition button. By the time the car pulls away, a connected vehicle may be generating signals about the door’s status, whether a passenger occupies the driver’s seat, the temperature inside, the sunroof’s position, and the entertainment system’s song information. The drive adds another layer: trip-start location, vehicle location and speed, brake application, headlight status, and oil level can all form part of the information flowing from a modern car, The Markup reported.
Each signal has an ordinary purpose inside the vehicle. Together, they create a running account of movement, condition, and the small choices that make up time in the cabin. The route begins somewhere. Speed changes with traffic. Brakes mark moments of response. A song or a temperature setting can place a human routine alongside the car’s mechanical status. Parking brings the trip to a close, while the record has already captured far more than distance traveled.
The volume rises quickly because the car is observing several kinds of activity at once. An estimate cited in a Future of Privacy Forum report projected that new information about vehicle use, wear and tear, and defects could grow from approximately 4 megabytes to more than 5 gigabytes per vehicle per month. That range gives a sense of the shift: the data comes from the ordinary operation of a machine people use every day, and it accumulates through repeated, familiar trips.
Connected cars collect huge amounts of information through internet-connected apps, including data that can be highly personal, according to The Markup. The useful way to see the modern car, then, is as a consumer device on wheels. It observes where the vehicle goes, how it moves, what state it is in, and parts of the environment passengers create inside it. Every commute, school run, errand, and late-night drive can add another entry to that record.
How the Car Became a Networked Device
Every commute, school run, errand, and late drive now rests on a technical foundation that has been building inside cars for decades. Computerized systems began appearing in vehicles as early as 1969, bringing electronics into a machine whose core work had long been mechanical. Those systems gained a common language in the 1990s, when on-board diagnostics, or OBD, became standardized.
That standardization began with a practical task: OBD systems were designed to watch major engine components, including the systems that control emissions. The Clean Air Act Amendments of 1990 made modern computer-based OBD systems a fixture in all 1996 and later light-duty vehicles and trucks, according to the Future of Privacy Forum. A port and a set of diagnostic rules gave technicians a consistent way to find mechanical trouble, while the vehicle itself gained an increasingly detailed account of its own performance.
Internet connectivity expanded what those onboard systems could do with that account. Modern vehicles increasingly carry technologies that access information through the internet and gather, store, and transmit data for entertainment, performance, and safety purposes, as an FTC staff perspective explained. The engine-monitoring computer became one element in a broader digital system, supporting the services drivers now encounter through screens, apps, and connected features.
That evolution also makes it important to separate two kinds of vehicle record that can sound similar. An Event Data Recorder, or EDR, focuses tightly on a crash or near-crash. It captures a several-second snapshot that can include pre-crash vehicle dynamics and system status, driver inputs such as steering and braking, seatbelt use and airbag deployment, and post-crash information such as activation of an automatic collision notification system. The Future of Privacy Forum describes EDR data as requiring direct physical access to the vehicle: a technician uses a scanning tool through the Diagnostic Link Connector, usually located beneath the dashboard.
That crash snapshot has firm boundaries. Automotive EDRs do not record audio, video, or location information, and their data is not remotely transmitted outside the car or retrieved by manufacturers without the owner’s consent. Connected systems work across a far wider span of ordinary driving, because internet access gives a vehicle the capacity to gather, store, and transmit information as the trip unfolds. The car’s long shift from diagnostic machine to networked device is what makes the next question unavoidable: once information can travel, where does it go?
Where Vehicle Data Goes After It Leaves the Dashboard
That capacity turns the car into the first link in a chain that extends well beyond the dashboard. Its computers process the information they receive, then transmit it by cellular radio to the manufacturer’s servers, where a record of the drive can become available for further use across a connected-vehicle system. From there, manufacturers can send data to businesses known as vehicle data hubs, which sit within a wider marketplace built around connected-car information, as The Markup reported.
The route matters because the market on the other end is already substantial. The Markup identified 37 companies participating in the connected-vehicle data industry, a field projected to be worth between $300 billion and $800 billion by 2030. That range reflects the value assigned to information generated during routine use of a vehicle, then moved through systems designed to organize, analyze, and distribute it. A drive begins with one car on one road; once its data enters this network, it can become part of a commercial product.
Companies working in this business frequently say the information they use is aggregated or anonymized. Those terms describe a central effort to turn individual vehicle signals into broader patterns that can be used across fleets, roads, and customer groups. Yet location and movement data carry particular privacy stakes precisely because a vehicle’s movements can form a distinctive record of where it has been and how it travels, according to The Markup. The same pipeline that creates a usable data product can therefore carry details with an unusually close connection to a person’s daily life.
That connection becomes concrete when the data reaches outside businesses. Reuters reported that automakers share or sell vehicle data to external entities, including insurance firms, which can use that information in decisions about premiums and renewals. The journey from a vehicle’s cellular signal to an insurer’s system gives an ordinary drive a second destination: a commercial network whose participants may never appear on the car’s display.
Why Cars Collect This Information in the First Place
That network begins with services that a driver can recognize in the moment. After a crash, a manufacturer may use precise geolocation to guide emergency personnel to the scene, turning a vehicle’s location into information with immediate practical value. Vehicle health data can also support services such as roadside assistance, while the systems inside the cabin make navigation, music, contacts, and internet access available during a trip, as described in the FTC’s connected-cars workshop report. Each function depends on the car knowing something about its condition, its surroundings, or the requests its occupants make.
That same knowledge can serve a wider public purpose once it is combined across vehicles. Connected cars can produce aggregate data for traffic management intended to reduce congestion, according to the FTC. The road itself can also become part of the safety system: vehicle-to-vehicle and automated safety technologies require cars to regularly send Basic Safety Messages about speed, direction, brake status, and other vehicle information to surrounding vehicles. In that setting, a car’s data helps create a shared picture of traffic, one that can support decisions beyond the vehicle generating the signal.
Insurance creates a more personal version of the same exchange. Some third parties offer dongles that plug into a car’s port and collect and transmit information about driving habits. Insurers can use driving-habit data to set consumer rates, and drivers who demonstrate good habits can qualify for discounts, the FTC report explains. A record of how someone drives can therefore become part of the price attached to driving.
Those uses give connected-car data its unusual pull. Location can help dispatch emergency responders. Vehicle health can help deliver assistance. Speed, direction, and braking can contribute to safety messages and traffic management. Driving habits can shape an insurance rate. The information carries value at each stop because one stream of data can support a service, a safety function, a product decision, or a commercial decision. That overlap sets up the central question for drivers: when a feature asks a car to collect information, how clearly does the driver understand every use that may follow?
What Drivers Are Actually Given a Choice About
Data can support a service, a safety function, a product decision, or a commercial decision, and that range of uses makes the driver’s choice unusually important. Yet only 28 percent of respondents in an Automotive Industries Association of Canada survey said they had a clear understanding of the kinds of data their vehicle produced. The same share said they clearly understood who had access to it, according to The Markup. That gap matters at the moment a driver is asked to agree, since a choice can only carry real weight when the person making it understands both the information at stake and the people who may receive it.
The federal government encountered that question in its review of connected vehicles. Of the 16 automakers the Government Accountability Office examined, 13 offered connected vehicles, and all 13 said they obtained explicit consumer consent before collecting data. For a customer who preferred to keep data from being shared, however, those automakers generally offered few paths beyond opting out of connected-vehicle services altogether, the GAO found. The result places a broad decision in front of the driver: accept the terms of a connected service or step away from the service itself.
That decision depends heavily on the notices surrounding it, and the GAO found a striking weakness there. All 13 automakers’ written privacy notices were easily accessible, yet every one lacked clear writing. Most of the automakers told the GAO they limited their collection, use, and sharing of data, while their notices failed to clearly identify those practices, according to the agency’s 2017 report. A separate account of the review found that the policies were laden with legalese and that the automakers’ reported practices generally described narrower activity than the notices suggested, as Inside Privacy reported. An accessible document can therefore leave a driver without a usable picture of the agreement.
The issue is larger than the wording of a screen or a form. Consent sets the terms for participation in services built around a continuing flow of vehicle information, so it needs to answer practical questions in plain language: what data is involved, who can access it, and which services depend on sharing it. The GAO identified transparency, focused data use, data security, access and accuracy, individual control, and accountability as the leading privacy practices most relevant to connected vehicles, its review concluded. Together, those principles describe the standard drivers need: clear information before they agree, followed by controls they can realistically use.
When Driving Data Reaches Insurance and Data Firms
That final principle, individual control, becomes concrete when a driver can see the record assembled from ordinary trips. Reuters reported that a consumer disclosure LexisNexis gave to a Chevy Bolt owner ran beyond 130 pages and detailed every drive across six months. The record included braking metrics and patterns, turning the familiar actions of a drive into a file with enough detail to fill page after page.
That file also shows where vehicle information can acquire a second use. Automakers share or sell vehicle data to external entities, including insurance firms, Reuters reported, and insurers can use the collected information when determining premiums and renewals. The connection matters because it carries driving data from the vehicle into a decision that can shape the continuing cost of coverage. A braking pattern recorded during one trip can therefore sit within a broader record used far from the driver’s seat.
That movement of data has also reached courtrooms. Recent class actions have alleged inadequate disclosure of collection and sharing practices, along with unauthorized sales of driver telematics. One class action filed in the Eastern District of Michigan against GM and OnStar alleges that data from a 2021 Cadillac XT6 was collected without permission and sold to LexisNexis Solutions. The Michigan complaint further alleges that GM and OnStar automatically enrolled customers in a data-collection scheme without explicit consent or their knowledge.
Those are allegations, and the cases will test them through the legal process. Their presence gives the consent question a sharper edge, however, because the dispute centers on the moment when a service becomes a data relationship and then a commercial one. A driver may experience a vehicle as a source of transportation and connected features, while the record generated along the way can become material for an insurer or a data firm. Disclosure and consent now sit at the center of that exchange, where a few words on a screen can shape who receives a far more detailed account of the drive.
A Fast-Growing Market Meets an Uneven Privacy System
The record generated along the way can become material for a chain of companies whose rules and responsibilities remain unevenly defined. The connected-vehicle data industry operates with few regulations governing the sale or use of vehicle data, even as the information can move from a manufacturer into a wider commercial marketplace. State laws add another patchwork: some give consumers a way to opt out of personal-information sales, yet the protections vary significantly and generally do not reach data from connected vehicles, Reuters reported.
That leaves the federal government carrying a central part of the privacy debate. The Federal Trade Commission has authority to protect consumer privacy, while the National Highway Traffic Safety Administration holds broad authority over passenger-vehicle safety. Their mandates meet inside the modern car, where systems built for driving also generate consumer data. In its 2017 review, the Government Accountability Office found that NHTSA had yet to clearly define its roles and responsibilities for vehicle-data privacy, and selected automakers and others described the agency's role as unclear. The GAO urged the Secretary of Transportation to direct NHTSA to define, document, and communicate those responsibilities, according to the agency's report.
Federal attention has continued to gather around the issue. U.S. lawmakers have threatened sweeping crackdowns on the collection, transfer, and sale of location data, a category with unusual sensitivity because movement records can reveal so much about a person's life, The Markup reported. The FTC has also placed connected cars directly within its consumer-data work: a May 14, 2024 article from the agency addressed unlawful collection and use of consumer data in connected cars, the FTC said.
The pressure for clearer rules follows the change drivers can already see in the windshield and feel in the dashboard. A vehicle can support safety functions, roadside help, navigation, entertainment, and other connected services while each trip produces information with commercial value. The practical question now reaches beyond whether data exists, because it plainly does. Drivers need to know who receives it, what happens next, and what choices remain available when a car's second job is building a file on how they drive.
Comments (0)