You drove to a hospital last Tuesday. You took a route that avoided the usual roads — maybe you didn’t want anyone to know where you were going. You parked, spent two hours inside, and drove home. You told no one.
Your car told General Motors.
The timestamp, the GPS coordinates, the route, the speed, the duration: all of it logged by the connected vehicle system. You agreed to it when you tapped “Accept” on the infotainment screen during setup. You probably don’t remember doing it. Most people don’t.
This is the privacy problem with modern cars. It’s invisible and comprehensive. And unlike the tracking on your phone, most people haven’t started paying attention to it yet.
What your car is actually recording
Connected cars are essentially smartphones on wheels, and they collect data at a similar scale.
Location history is the most obvious. Your car’s GPS logs where you go, when, for how long, and at what speed. This isn’t just for navigation — it’s stored and transmitted to the automaker’s servers. Over months, that record is a detailed map of your life: which doctor you visit, which mosque or temple, which political offices, which other addresses you stop at regularly.
Driving behavior goes deeper. Hard braking events, rapid acceleration, sharp cornering, time of day you drive — all of it feeds telematics systems that insurers pay to access. The data isn’t abstract. It’s used to make decisions about what you pay.
Infotainment systems are a particular problem. When you connect your phone via Bluetooth or USB to play music or use hands-free calling, most cars pull in more than you intend. Call history. Contact lists. Text message previews. Some systems cache this data locally in a way that persists long after you’ve disconnected the phone — or sold the car.
Voice recordings from in-car assistants are processed by those companies under their own privacy policies. That covers Amazon’s Alexa Auto, Google Assistant, and Apple’s Siri through CarPlay. It layers on top of whatever the automaker collects. Two sets of data collection. Two companies with access. One conversation about where you’re going.
Exterior cameras add another layer. Tesla stores footage captured by its cameras around events like collisions, sudden braking, and sentry mode activations. Footage from a camera pointing at a public street is one thing. Footage stored on Tesla’s servers, associated with your account and your location history, is another.
The investigation that should have made headlines
In September 2023, the Mozilla Foundation released the most comprehensive privacy audit of automobiles ever published. Their Privacy Not Included project evaluated 25 car brands against standard privacy criteria. All 25 failed.
Mozilla called cars “the worst product category we have ever reviewed for privacy.” That’s a meaningful statement from a team that has audited hundreds of products across years: routers, children’s toys, health apps, smart home devices. Cars beat all of them for data overreach.
The specifics were striking. Nissan’s privacy policy allowed the company to collect and share data about “sexual activity” as inferred personal information. That category appears nowhere in the actual function of driving a car. It raises obvious questions about how it gets inferred and why Nissan thought it needed that right. Kia’s policy allowed sharing driver data with law enforcement without a court order: no warrant required, just a request. Across the 25 brands, 84% said they could share data with government or law enforcement. Most shared or sold data to third parties.
None of this is a secret. It’s in the privacy policies. The policies are just written to be unread.
When car data raised insurance premiums
The abstract became concrete in March 2024. The New York Times reported on General Motors’ OnStar Smart Driver program, a telematics service that collected detailed driving behavior data from enrolled customers. That data was shared with LexisNexis and Verisk, two major data brokers whose clients include insurance companies. Many drivers enrolled in OnStar without fully understanding what data would flow to whom. They then found their insurance premiums raised based on driving scores they had no way to review or contest.
GM suspended the data-sharing partnerships following the reporting. But the episode illustrated exactly how the pipeline works. The automaker collects data and sells it to brokers. The brokers sell it to insurers. The insurers act on it, and the driver is the last to know.
Where India sits in this picture
India’s car market is moving fast toward connectivity. Maruti Suzuki, Hyundai, Tata Motors, and MG Motor all offer connected vehicle features with telematics, location services, and remote monitoring through their companion apps. These systems collect location and behavioral data as a core function. The data policies governing them vary — and most have not been subjected to the kind of scrutiny Mozilla applied to the global brands.
Ola Electric is worth naming specifically. The S1 scooter collects real-time location, battery data, and riding behavior through the Ola Electric app. That’s personal data by any reasonable definition. India’s Digital Personal Data Protection Act 2023 applies to exactly this kind of data. Location history and behavioral profiles qualify as personal data under the Act. The companies collecting it are data fiduciaries with corresponding obligations.
No Indian automaker has faced regulatory action over connected vehicle data as of mid-2026. That’s not reassurance. It’s a gap. Enforcement infrastructure under the DPDPA is still being built. The data is being collected now.
The second-hand car problem nobody mentions
If you sell a car, buy one second-hand, or return a lease vehicle, the infotainment system may still contain the previous owner’s data — contacts, call history, saved locations, paired device records. Factory resets are not always performed between owners. Dealerships don’t reliably check.
This cuts both ways. The person who buys your car after you may be able to see where you drove, who you called, and which phone you used. And you may be driving around in a car that still holds someone else’s data.
What you can do
Factory reset the infotainment system before you sell, return, or trade in your car. The option is usually in Settings under System or Privacy — search the car model and “factory reset infotainment” if you can’t find it. Do not assume the dealership will handle this.
Opt out of connected services data sharing where offered. Look in the vehicle settings under “Privacy,” “Data Sharing,” or the companion app settings. Not all manufacturers offer a meaningful opt-out, but some do. Check before assuming the default is fine.
For insurance telematics programs: Read the full disclosure before enrolling. Understand specifically whether the data goes to third parties beyond your insurer, and which ones. The GM/LexisNexis situation was not unique — it was the one that got reported.
Don’t pair your primary phone contacts with the car if contact privacy matters to you. Use a different device, or set up Bluetooth for audio only and handle calls through the phone itself.
Read the “third parties” and “law enforcement” sections of your automaker’s privacy policy. Those two sections tell you almost everything you need to know about where your data goes and under what conditions. Most people have never looked.
Check your automaker’s privacy settings annually. Policies update. Default settings change. A feature that required opt-in last year may have become opt-out this year.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.