How Your Car Spies on You in 2026 and Beyond

In September 2023, the Mozilla Foundation reviewed 25 car brands for privacy. Every single one failed. ^[1] Cars are now the worst product category Mozilla has ever reviewed, worse than sex toys, worse than mental-health apps, worse than period trackers. Not a single automaker met the minimum bar Mozilla's researchers set.

That finding is two and a half years old. The picture has only gotten worse. In the time since, U.S. regulators have run three separate enforcement waves against automakers and data brokers for the same practices. None of them stopped the underlying flow. Your car still knows where you go, when you go, how fast you drive, who you call, what you weigh, and whether you fastened your seatbelt. That data still ends up in the hands of insurance companies, data brokers, marketing firms, and law enforcement. And the new cars shipping in 2026 and 2027 will collect more of it, not less.

Here is who has your driving data, who makes money on it, and where the data economy goes next.

What Your Car Knows About You Right Now

Every connected car on the road today is a phone on wheels with a 100+ sensor payload. The Controller Area Network (CAN bus) on most modern vehicles records accelerator position, brake pressure, steering angle, wheel speed, and seatbelt status continuously. Add GPS, the cellular modem, the infotainment unit, the in-cabin camera, the microphone for voice commands, the companion app on your phone, the key fob, and the tire-pressure sensors, and you have a car that knows a startling amount about you.

The Senate Commerce Committee staff, led by Senator Ed Markey, published a 50+ page report in January 2024 titled Tracking America: How Big Data Drives Cars and Trucks. ^[2] The report's central finding: drivers have no meaningful way to know what data their car collects, no meaningful way to opt out, and in most cases no meaningful consent surface at all. The consent screen you may have seen at the dealership, the one where you signed on a tablet, was almost always for the infotainment system. The deeper telematics channels, the ones the OEM actually monetizes, are governed by privacy policies that most drivers never read and could not opt out of even if they did. Senator Markey followed up in February 2024 with letters to 14 automakers asking specifically about driver-monitoring cameras, eye-tracking, and biometric data on teen or passenger drivers. ^[3] Consumer Reports walked through what the policies actually say in plain English. ^[4] The plain-English version: most of it. The Federal Trade Commission's staff paper in February 2024 concluded the lack of meaningful consumer choice is structural. ^[5] Read that as: there is no opt-out knob to turn.

The Scale of the Problem

25 brands reviewed. 25 failed. The data ranges from precise GPS to cabin video to biometric eye-tracking. The opt-out surface is, in most cases, "don't buy the car".

For a device-level breakdown of the sensors, dongles, and apps that each form a separate data channel, see our guide to car tracking devices. For the broader IoT pattern, with 41.6 billion connected devices and rising, see the 41.6 billion connected devices watching you.

The Black Box Most People Forget: Your EDR

Before any of this connected-car telemetry existed, U.S. cars were already required to carry an Event Data Recorder, a "black box" that captures the seconds before, during, and after a crash. The EDR records speed, throttle position, brake use, seatbelt status, and airbag deployment timing. The Electronic Frontier Foundation has been tracking the legal status of EDR data for years. ^[6]

EFF's position: EDR data is your data, and law enforcement should need a warrant to pull it. The case law is mixed. Some states explicitly require owner consent; others treat EDR data like any other physical evidence. If you crash, the EDR will likely end up in an insurance investigation or a criminal case. If you don't crash, it sits in your car collecting another layer of metadata that a future subpoena or search warrant can read.

For the full mechanics of what an EDR records and who can read it, the EFF's EDR legal primer is the cleanest starting point. There is not yet a dedicated explainer on this site; the dossier below flags it as a gap.

Where the Data Goes: The OEM-to-Broker Pipeline

This is where the story gets financial. Your car collects the data. Automakers sell the data. Data brokers package it. Insurers, law enforcement, and marketing companies buy it.

The most-cited investigation of this beat came out of 404 Media and Wired in February and March 2024. ^[7] ^[8] General Motors, through its OnStar subsidiary, was selling detailed driving data to LexisNexis Risk Solutions. LexisNexis was packaging the data into a product called "Telematics Exchange" and reselling it to insurance companies. One plaintiff in a class-action suit later discovered 331 separate "events" in his LexisNexis file, each one a snapshot of when he drove, where he drove, and how he drove. His insurance premium had been raised without explanation.

GM and OnStar settled with the FTC in December 2024 over the geolocation and driver-behavior data sales. ^[9] The settlement required GM to stop the practice without explicit consent. It did not unwind the data already sold, and it did not stop other OEMs from doing the same thing. BMW, Subaru, and Tesla appeared in similar investigations through 2024. ^[10] The location-data broker business is the upstream context the car data flows into. For how that data ends up in federal agency hands, see broker-to-ICE contracts. For the dossier-assembly process, see how brokers build your profile.

Insurance telematics is the cleanest profit example. Progressive's Snapshot program collects and prices data the way Progressive wants to price it. ^[11] Tesla Insurance scores drivers on a "safety score" from real-time telemetry. ^[12] Both offer a "discount" in exchange for the data; the actual price of the discount, in driver privacy, is rarely on the disclosure form.

The brokers themselves are not invulnerable. In March 2026, a breach of LexisNexis exposed data on federal judges and DOJ attorneys, attributed to FulcrumSec. ^[13] The exposed data included records from the OEM telematics pipeline. When the broker holding the dossier gets popped, every driver's record in it gets popped with it. The Toyota class-action over the same data-broker resale pattern is still working through the courts. ^[14]

Regulators are catching up. The California Privacy Protection Agency's 2026 connected-car sweep hit Honda and Ford with settlements, the FTC's GM/OnStar case was finalized in December 2024, and the FTC's broader 2026 enforcement wave against location-data brokers (the Kochava case) is now blocking the worst offenders at the broker level. ^[15] ^[16]

License Plate Readers: The Camera Network You Don't See

The car data flows don't stop at the OEM. The same vehicles get scanned at highway speed by automated license plate reader (ALPR) networks. The dominant private network in the U.S. is Flock Safety. By Flock's own disclosures, the network runs more than 80,000 cameras, has contracts with over 5,000 law enforcement agencies, and logs around 20 billion license plate reads per month. ^[17] ^[18]

Flock's network is built on a "national lookup" feature: opt in, and your department's cameras get searched by every other Flock department in the country. A 2026 class-action lawsuit in California documented more than 1.6 million searches of California plate data by federal agencies, including Immigration and Customs Enforcement. ^[19] U.S. Customs and Border Protection runs its own dragnet on top of this, with documented read-shares across state lines. ^[20] For the site primer on how Flock operates as a business, see our Flock Safety primer. For the scale-and-access angle, see the 20B-scans-a-month Flock network.

The pushback is real. By May 2026, at least 80 U.S. cities had canceled or deactivated their Flock contracts after audits found unapproved federal searches, default-on sharing toggles, and contracts that locked cities into years of data exposure they could not easily exit. ^[21] A 2025 crowdsourced map by the group DeFlock documented 90,000 Flock camera locations; the resulting cancel-wave is what most cities cite when they decide to leave. ^[22] For a list of cities that have won against Flock, see the cities that have beaten Flock.

ALPR is not just Flock. Axon, the same company that supplies body cameras and tasers to most U.S. police departments, has been building its own ALPR network since 2023. ^[23] For the underlying mechanics of how ALPR works, see our license-plate-reader primer. Customs and Border Protection runs plate-reader hits at and between ports of entry, with documented sharing across state lines and limited warrant practice. ^[20] The ACLU and EFF filed a 2026 lawsuit against San Jose over the city's mass deployment of ALPR cameras without adequate retention limits. ^[24]

Toll Transponders: The E-ZPass Problem

The E-ZPass in your windshield, the FasTrak, the SunPass, the TxTag, the I-PASS, all of these are radio transponders that broadcast your vehicle's presence every time you pass a reader. The readers are mostly at toll plazas, but the metadata is richer than a single toll payment.

A 2017 New York Times investigation showed the E-ZPass system was being used to track drivers far beyond the toll-road network, with private contractors buying access to per-trip data. ^[25] In 2024, the EFF filed an amicus brief at the U.S. Supreme Court arguing that toll records are protected by the Fourth Amendment. ^[26] The Second Circuit's 2024 ruling in the NY toll-data litigation was a partial win for drivers' privacy. ^[27] The Center for Democracy & Technology's policy analysis walks through the trade-off. ^[28] Rekor Systems has been building a parallel map of American license plates from private-camera data, sold to insurers, repossessors, and law enforcement. ^[29]

The State of Surveillance site currently has no dedicated article on E-ZPass and toll transponders; this is one of the gap items in the related-article list at the bottom of this page.

The Apps in Your Pocket Finish the Job

Even if you bought a car with the telemetry turned off, the phone in your pocket completes the picture.

Google Maps is the canonical example. Kashmir Hill's 2023 New York Times investigation showed that Google Maps continues to record your location even when you have explicitly told it not to. ^[30] The "opt out" toggle does not, in fact, opt out. Waze, owned by Google, plays the same game. Apple Maps anonymizes queries on-device. ^[31]

GasBuddy settled FTC charges in 2023 for using precise location data to sell targeted ads. ^[32] The same enforcement wave that hit GasBuddy is now hitting the location-data broker upstream: the FTC's Kochava settlement, finalized in 2026, blocks the worst of the resale pipeline. ^[16] And the "opt out" signals browsers send are not being respected: a 2026 audit found Google ignored the Global Privacy Control signal 86% of the time. ^[33]

The OBD-II dongle you bought to clear your own check-engine light is its own channel. The Bluetooth dongle, the $30 aftermarket reader, the Torque app, the Carly adapter, these are phoning home with vehicle data on a separate network from the OEM. ^[34] The dealership service bay also has direct OBD-II access; every software update or recall fix is another read. ^[35] For a walkthrough of what you can actually disable, see our car-data opt-out guide.

How It Gets Worse: 2026, 2027, and Beyond

Three regulatory and technical shifts are about to dramatically increase the data your car collects and who can read it.

The first is the federal connected-car rule. The U.S. Department of Transportation finalized a rule in 2026 that prohibits Chinese-built connected-car software and hardware from U.S. vehicles on national-security grounds. ^[36] The rule is being framed as a privacy and security measure, but the practical effect is to harden the existing OEM data pipeline rather than reduce it.

The second is the DADSS mandate. The Driver Alcohol Detection System for Safety, a passive in-cabin alcohol sensor, is now on a federal mandate timeline for 2027 model-year vehicles. ^[37] The system is supposed to be a safety feature; it will, in practice, also be a continuous biometric monitor that knows every second of every drive whether the driver has been drinking. The privacy architecture around who can read that data is still being written.

The third is V2X, vehicle-to-everything communication. The Department of Transportation's 2024 technical report on V2X privacy is honest about what V2X broadcasts: position, speed, heading, and a rotating identifier that can be correlated across receivers. ^[38] V2X is being rolled out under the banner of safety and traffic efficiency. It is also a continuous vehicle telemetry channel that any nearby V2X-equipped receiver can pick up.

Inside the cabin, the in-cabin camera and microphone story has only gotten darker. A 2023 investigation documented Tesla employees sharing sensitive in-cabin camera video internally "for fun". ^[39] Tesla's privacy policy allows for the practice, and the cars in question had not been opted out.

On the consumer side, the subscription-gated hardware model is spreading. BMW made headlines in 2022 for charging a software subscription to use the heated seats your car already had. ^[40] Tesla took the model further in 2023 with a "feature menu" of software-locked performance upgrades. ^[41] More of the car's functionality is now software, and software is now subscription, and subscription is now a recurring relationship with the OEM that includes a recurring data flow.

What You Can Do About It (And Why the Cards Are Stacked)

The honest answer: not much, at the individual level. The data collection is structural. There is no setting on a 2026 car that says "do not collect my biometrics, do not sell my location, do not share with brokers, do not respond to law-enforcement queries without a warrant". The opt-out steps that do exist are partial, brand-specific, and easily undone by the next software update.

The actionable version is in our car-data opt-out guide, which walks through the specific toggles and account settings that do exist. For data-broker-level remediation, our data-broker opt-out guide covers the LexisNexis, Verisk, and EDR opt-out flows, and DataPurge is a free, open-source tool for the broker-removal side.

The structural answer is in the regulatory beat. The CPPA's 2026 sweep, the FTC's GM/OnStar settlement, the Texas AG action against Allstate and Arity, the 2026 federal connected-car rule, the 2027 DADSS mandate, the active state-level location-data broker bans: these are the levers that move the needle. They move slowly and they tend to harden the existing data flow rather than dismantle it, but they are the only path that does not require millions of individual drivers to each negotiate with their OEM.

The car on the road in 2026 is the most data-rich consumer device most people own, and the data flow runs through a small number of OEMs, brokers, and insurers, with a federal regulatory floor that is still being written. The 2027 DADSS mandate, the V2X rollout, and the subscription-feature model are all on track to expand that flow. The cities canceling Flock contracts are the only countervailing force with real momentum on the ground. The ACLU/EFF San Jose lawsuit and the state-level location-data broker bans are the legal architecture it will rely on.