Cars are selling driver data to brokers, and Washington's fixes may miss the point

The Federal Trade Commission's penalty against General Motors earlier this year was unprecedented: a five-year ban on selling customer data to consumer reporting agencies and third-party data brokers. In The Verge's Stepback newsletter, Andrew J. Hawkins traces how cars became one of the most invasive consumer devices on the market, and why the policy response may be missing the point.

How it started

For years GM collected data on its customers, such as how often they sped or whether they drove at night, and sold it to brokers that build risk profiles for insurance companies. Many drivers were unaware: they consented by signing up for an OnStar connected services plan, which activated a feature called Smart Driver that collected their driving data. GM shared that data with LexisNexis and Verisk, two brokers working with the insurance industry, and in a 2024 investigation by The New York Times some drivers said their rates rose as a result. The enrollment process was confusing enough that many owners had no idea their data was being shared. Under the settlement, GM must make it easier to turn off location tracking and let drivers access and delete the data it collected.

Every automaker, the same findings

GM is not alone. Researchers from the Mozilla Foundation spent months examining the privacy policies of all the major car companies for a 2023 report and concluded that every single one had horrible privacy and security, said Jen Caltrider, who helped author the study. Owners also had to accept overlapping policies for the car, the connected services, the smartphone app and the financial services behind their loan, all of them containing data collection provisions. Consumer Reports reached a similar verdict: nearly every automaker selling cars in the US collects and shares so-called driver behaviour data with other companies, and continues to do so. Cars are harder to reason about than phones because collection is spread across multiple systems and policies, and the controls are less intuitive.

The policy response

In December, three House Republicans introduced the Data Rights for Information and Vehicle Electronics in Real-time, or DRIVER, Act, arguing that if you own the vehicle you should own the data it generates. It would give owners more control, but still allow automakers to gather and sell data to third-party brokers, a nonstarter for privacy advocates, since access and deletion rights are not the same as preventing excess collection and the burden stays on the individual. The issue has reached MAGA circles too: last July, Transportation Secretary Sean Duffy sent Congress a letter on the surface transportation reauthorization bill that floated the Freedom Car, a right to drive disconnected and non-automated vehicles, barring the government from requiring automated driving systems or wireless data transmission.