Does your car track you?
Many newer cars can collect location and driving data, according to reviews of automaker privacy policies by Consumer Reports and Mozilla. Regulators and U.S. senators have reported that some automakers shared driving data with data brokers used by insurers. Before you buy: ask what's connected, turn off data sharing you don't want, and request your free LexisNexis report.
What the labels mean
- High Based on public reports: for the years or program shown, a regulator's settlement or the company's own statements to regulators or senators say driving data was shared with data brokers used by insurers.
- Heightened Based on public reports: the brand has run, or is alleged in a lawsuit or investigation to have run, programs that share driving data with insurers or data brokers, or its cars have in-cabin cameras.
- Standard Based on public reports: the automaker's policy says it can collect location and driving data; we found no public report of a sale to data brokers. Review its privacy settings.
Settled: the company agreed to terms with a regulator; a settlement is not a court finding that the law was broken. Alleged: a claim in a lawsuit or investigation that hasn't been proven. Reported: from news or research reports. Company-stated: what the company's own policy or statement says. Labels describe a brand or program, not any specific car or driver.
Pick a make
GM High
GM (Chevrolet, Buick, GMC, Cadillac)
High cars in OnStar Smart Driver, through 2024 · Heightened new
Collected (per the FTC): precise location and driving behavior data. Company-stated: GM's current privacy policy also lists exterior camera clips (with consent or after a safety event) and AI-assistant data if used.
Settled: according to the FTC, GM settled FTC allegations that it collected and sold OnStar Smart Driver location and driving data without consumers' informed consent. The FTC finalized the order Jan 14, 2026: a 5-year ban on sharing that data with consumer reporting agencies, and for 20 years, consent, access, deletion and opt-out requirements. According to the California Attorney General, GM agreed to a $12.75M settlement (announced May 8, 2026, subject to court approval) over alleged sales of Californians' data to two data brokers.
Alleged: Texas has also sued GM; those claims are unproven (The Record).
Opt out (company-stated): disconnect via an OnStar advisor or the blue button. GM says some 2019+ cars have an in-car setting to disable location services (emergency exceptions apply), and 2025+ cars include OnStar Basics for up to 8 years, which you can decline.
Sources: FTC (2026), California AG, GM privacy, OnStar Basics
Hyundai High
High Bluelink cars, 2018–2024 · Standard new
Collected: driving behavior (Drive Score); Hyundai's policy also covers location via Bluelink.
Reported by U.S. senators: according to a July 2024 letter from Sens. Wyden and Markey, Hyundai told them it shared driving data from 1.7 million vehicles with data broker Verisk, 2018–2024, and enrolled drivers by default. Company-stated: Hyundai says the letter mischaracterizes its consent process (The Record). The letter says Verisk shut down the related product in April 2024.
Opt out (company-stated): unenroll from Bluelink to withdraw location consent.
Sources: Wyden/Markey letter (Jul 26, 2024), The Record, Hyundai privacy
Honda / Acura High
High Driver Feedback enrollees 2020–2024 · Standard new
Collected: driving behavior via the opt-in Driver Feedback app.
Reported by U.S. senators: according to the same letter, Honda told them it shared data from 97,000 cars enrolled in Driver Feedback with Verisk, 2020–2024; the senators say the disclosures were buried in the terms. The letter says Verisk shut down the related product in April 2024.
Settled: according to California's privacy agency (CPPA), Honda agreed to pay a $632,500 fine and change its practices (Mar 2025) to resolve allegations that its privacy-request process was too hard to use.
Opt out (company-stated): contact Honda to deactivate; separate in-car or app opt-outs may also be needed.
Sources: Wyden/Markey letter, CPPA, Honda notice
Toyota / Lexus Heightened
Heightened
Collected (company-stated, Toyota's notice): location, driving data (acceleration, braking), vehicle health, voice; opt-in interior face scan and exterior cameras on some models. Driving data may be kept up to 15 years.
Sharing: Toyota's policy says it shares with insurers only with express consent. Alleged: a Texas lawsuit against Allstate and its Arity unit alleges they bought vehicle data from Toyota and Lexus. Toyota is not a defendant, and the claim is unproven.
Opt out (company-stated): opt out or request DCM data-transmission deactivation via the SOS button, Customer Care, or the app.
Sources: Toyota notice, Texas petition (Jan 13, 2025)
Stellantis Heightened
Stellantis (Chrysler, Dodge, Jeep, Ram, Fiat, Maserati, Alfa Romeo)
Heightened (allegation)
Alleged: a Texas lawsuit against Allstate and its Arity unit alleges they bought vehicle data from Chrysler, Dodge, Fiat, Jeep, Maserati and Ram. The automakers are not defendants, and the claim is unproven. According to The Record, Texas sent FCA US a demand for information in January 2025 (an investigation, not a finding).
Opt out: unclear; policy not yet reviewed. Use the automaker's privacy portal.
Sources: Texas petition, The Record
Mazda Heightened
Heightened (allegation)
Alleged: a Texas lawsuit against Allstate and its Arity unit alleges they bought vehicle data from Mazda. Mazda is not a defendant, and the claim is unproven.
Opt out: unclear; policy not yet reviewed.
Source: Texas petition
Kia Heightened
Heightened
Reported: according to Consumer Reports, data broker LexisNexis has a partnership with Kia. According to The Record, Texas sent Kia an investigative demand in 2024 (an investigation, not a finding).
Opt out: check Kia's privacy settings and file privacy requests.
Sources: Consumer Reports (2025), The Record
Subaru Heightened
Heightened
Reported: security researchers reported (Jan 2025) a flaw in a STARLINK employee portal that exposed about a year of car location history; they say Subaru fixed it within a day. According to Consumer Reports, LexisNexis has had a partnership with Subaru. According to The Record, Texas sent Subaru an investigative demand in 2024 (an investigation, not a finding).
Opt out: Subaru's online privacy portal (Consumer Reports uses it as an example).
Sources: Consumer Reports, The Record, Curry (Jan 2025)
Mitsubishi Heightened
Heightened
Reported: according to Consumer Reports, Road Assist+ app data (hard braking, nighttime driving, speeding events) goes to a LexisNexis telematics exchange used by insurers. According to The Record, Texas sent Mitsubishi an investigative demand in 2024 (an investigation, not a finding).
Opt out: Consumer Reports says you can turn off “Trip Recording” in Road Assist+.
Sources: Consumer Reports, The Record
Ford / Lincoln Standard
Standard
Collected (company-stated, Ford's notice): connected-vehicle data including VIN and modem IDs; location depending on settings.
Company-stated: Ford's notice says it may sell or disclose some data to partners. Ford told The Record it doesn't sell connected-vehicle data to data brokers and never shared connected-vehicle data with LexisNexis or Verisk.
Settled: according to California's privacy agency, Ford agreed to pay a $375,703 fine and change its practices (Mar 2026) over an email-verification step it required before opt-outs.
Opt out (company-stated): in-car data settings; a Master/Factory Reset (Ford says deleting the app alone doesn't stop sharing).
Sources: The Record, Ford notice, CPPA
Nissan / Infiniti Standard
Standard (broad policy)
Reported: Mozilla's 2023 review said Nissan's policy lists very broad data categories, including a biometric category.
Company-stated: Nissan's policy says it doesn't sell driving data to insurers without consent. We found no public report of a sale to data brokers.
Opt out: state-law opt-outs.
Sources: Mozilla, Nissan policy
Volkswagen Standard
Standard
Company-stated (VW's privacy page): DriveView is opt-in and uses speed, braking, night driving, idle and GPS data. Insurer sharing is opt-in, lasts 20 days/20 trips, and you can opt out anytime.
Opt out (company-stated): turn off “Third Party Data Sharing” in myVW; a factory reset unlinks the account.
Source: VW privacy
Tesla Heightened
Heightened (cameras)
Collected: Teslas have exterior and cabin cameras and collect vehicle analytics.
Reported: Reuters reported in 2023 that former employees said staff shared customer camera clips internally, 2019–2022. We found no public report of a sale to data brokers.
Opt out: the car's Data Sharing settings.
Source: Reuters (2023)
Rivian Heightened
Heightened (cabin camera; strong controls)
Company-stated (Rivian's policy): collects interior camera data (with a sharing setting), voice and location; doesn't share data with insurers without consent.
Opt out: per-profile privacy settings. Rivian's policy says precise location is still sent for SOS, and coarse location is always sent.
Source: Rivian policy
Mercedes-Benz Standard
Standard
Reported: Mozilla's 2023 review said the policy lists precise geolocation, biometric data and emergency health info. We found no public report of a sale to data brokers.
Source: Mozilla (2023)
BMW Standard
Standard
Collected: not yet reviewed in detail.
Company-stated (as reported by InformationWeek, 2023): BMW said it doesn't sell in-vehicle personal info and that deletion is available.
Source: InformationWeek (2023)
Not yet researched: Genesis, Volvo, Polestar, Porsche, Jaguar Land Rover and newer EV brands. No label here does not mean a car collects nothing.
What you can do
- At the dealer: ask whether the car has an active modem or connected service and what you're agreeing to. You can usually decline optional programs (GM says OnStar can be declined).
- Check the settings in the car and the automaker app: turn off location sharing, driving scores, insurance sharing and camera analytics you don't want.
- File privacy requests with the automaker: opt out, limit, delete.
- Ask for telematics deactivation where offered (Toyota DCM deactivation, GM OnStar disconnect). You may lose SOS, crash notification and remote features.
- Used car: do a master/factory reset, remove the prior owner from the app, and register your own account.
- Selling or trading in: unpair phones, delete contacts, addresses and garage codes, and cancel or transfer connected service (FTC).
- See what brokers have: request your free LexisNexis consumer disclosure report (LexisNexis).
VIN-locked parts
Some parts are tied to the car's VIN and may need programming after a repair. Items backed by official or industry sources:
- Engine/body computers (ECM/BCM) and keys, all brands: according to NASTF, after replacing security parts like the ECM or BCM, the car must be reprogrammed to recognize them. Key codes and key programming are limited to credentialed security professionals (NASTF).
- Stellantis secure gateway, most 2018+ models: according to the AutoAuth overview, it blocks some repair-tool functions (like clearing codes) unless the shop's tool is authenticated. Reading diagnostic data still works (AutoAuth overview).
- Tesla salvage and total-loss cars: according to Tesla's service bulletin, warranty void, fast charging off until a paid inspection passes, and high-voltage restricted parts not sold to owners (Tesla bulletin).
Other parts (for example infotainment, airbag modules, EV batteries, or used modules from another car) may require programming; ask a shop.
Last checked Nov 4, 2026 · Based on public reports and linked sources. Not legal advice. Laws and company practices change. Spot an error? Email support@thelotdog.com