Your car knows when you’re home. It knows when you leave, how often you drive, and where you go. If you work from home, that pattern — no regular commute, fewer trips during weekdays — is part of the data your vehicle may be transmitting to manufacturers, data brokers, and insurers. You didn’t sign up for that, but the dashboard might have done it for you. Most of what’s documented about connected car data collection comes from the FTC’s enforcement action against General Motors and the Mozilla Foundation’s privacy analysis, and it paints a picture of a system designed to gather as much as possible with as little friction as possible.
Data Privacy
Connected Cars
Remote Work
Insurance
This post contains affiliate links.
What Your Car Collects — and Why It Matters for WFH
According to McKinsey, roughly half of cars on U.S. roads had internet connections by 2021, and that number is expected to hit 95% by 2030. Your car’s telematics control unit — a cellular modem embedded in the vehicle — can transmit precise location, speed, braking force, and even cabin audio to the manufacturer’s cloud. In GM’s case, the FTC found that location was sampled every three seconds, creating a detailed map of where you park overnight, where you spend your days, and every detour in between.
If you work from home, that map shows you’re home during standard business hours. It shows you don’t have a daily commute. It may also capture the occasional trip to the coffee shop, the midday errand, or the weekend drive. Alone, each data point seems innocuous. Combined, they form a behavioral profile that can be sold or shared without your meaningful consent. The Mozilla Foundation’s 2023 review of 25 major car brands concluded that connected cars are “the worst product category we have ever reviewed for privacy”.
The Pipeline from Dashboard to Insurer
Collected data doesn’t stay in the car. It flows through a four-node pipeline, as detailed in the FTC’s enforcement action against General Motors. The manufacturer collects telemetry, sells it to analytics companies like Verisk and LexisNexis, which then sell scored risk profiles to insurers. The result: your driving behavior — hard brakes, late-night trips, even the fact that you rarely drive — can influence your insurance premiums without you ever knowing.
In one documented case, a Chevy Bolt driver received a 130-page LexisNexis disclosure report covering every drive over six months, including speed, braking intensity, and acceleration patterns. According to reporting by The New York Times, that driver’s insurance costs jumped 21% after the data was shared. Class action lawsuits filed against GM, OnStar, and LexisNexis — Chicco v. General Motors and Reed v. General Motors — allege that drivers were enrolled in data-sharing programs without explicit consent, sometimes without any subscription to OnStar Smart Driver.
If you own a GM vehicle from model years 2016–2024 and had OnStar connected services active, your driving data may have been sold to LexisNexis and Verisk. Some drivers saw premium increases of 20–40%. The FTC’s 2026 consent order now bans GM from sharing geolocation and driving behavior data with consumer reporting agencies for five years, but data from other manufacturers may still be flowing.
The Consent Trap in Your Dashboard
Automakers argue that you consented when you tapped “Agree” during infotainment setup or paired your phone. But that consent is often functionally coerced: decline data sharing and you lose navigation, live traffic, remote start, or over-the-air updates. The Mozilla Foundation found that 19 of 25 car brands said they might sell personal data, and several — including Nissan — claimed the right to collect deeply sensitive categories like sexual activity, health diagnoses, and genetic information. Nissan’s privacy policy, which Mozilla researchers described as “the most mind-boggling, creepy, scary, messed up privacy policy we have ever read,” states it can share data on “formal or informal” requests from law enforcement.
For the remote worker, the consent trap is especially insidious. You might connect your phone to the car for hands-free calls during the occasional work-from-home errand. That connection can grant the infotainment system access to your contacts, call logs, message previews, and app data — all of which become part of the vehicle’s data profile, often without a second prompt.
What Regulators Are Doing — and What They’re Missing
The past two years have seen the most significant regulatory action in connected vehicle data history. In January 2025, the FTC filed its first complaint targeting connected vehicle data, alleging GM and OnStar collected and sold geolocation data without adequate consent. The finalized consent order in January 2026 imposes a five-year ban on sharing such data with consumer reporting agencies. In May 2026, California Attorney General Rob Bonta announced a $12.75 million settlement with GM — the largest CCPA penalty ever — requiring deletion of retained data within 180 days.
But these actions target only one manufacturer. Meanwhile, a new federal mandate will require automakers to install infrared biometric cameras and systems to detect impaired driving, with zero provisions limiting what companies can do with the resulting biometric and health data. As Darrell West of the Brookings Institution put it, “your life can be recreated almost on a second-by-second basis.” The DRIVER Act, introduced in the House, would reaffirm that vehicle owners own their data, but privacy advocates say it falls short by allowing continued collection and sale.
⚡
Practical Steps to Reclaim Your Privacy
You can’t fix the whole system, but you can reduce your exposure. Start with the vehicle itself: dig into the infotainment menu under “Connectivity,” “Privacy,” or “Data Services” and disable any non-essential data sharing. Many manufacturers also offer privacy controls in their companion smartphone apps — check permissions at the OS level, setting location to “While Using” rather than “Always.”
A more thorough approach involves requesting your data from the brokers. If you own a GM vehicle from 2016–2024, California residents can request a LexisNexis CLUE report and a Verisk consumer data file to see if driving data was shared. The deadline for GM’s deletion obligation under the California settlement is roughly November 2026, so act soon. For other states, the process is less straightforward, but the FTC’s consumer guidance recommends clearing personal data before selling or returning a vehicle.
- Review infotainment privacy settings — turn off “Data Sharing” or “Cloud Sync” where available.
- Audit your manufacturer app permissions on your phone: set location to “While Using,” revoke microphone and contacts unless actively needed.
- Use a VPN on your phone when using EV-related apps to encrypt traffic from mobile carrier and reduce cross-app tracking. A reliable option like ExpressVPN can help secure your mobile data in these scenarios.
- Set up a password manager for all EV and charging network accounts — unique credentials prevent credential stuffing if an account is compromised.
- Monitor your insurance rates for unexplained increases and request a LexisNexis consumer disclosure if you suspect data sharing.
For the WFH crowd, there’s an extra layer: treat your car like a rolling smartphone. If you’ve connected your work phone or synced contacts, delete them before handing the car over for service or sale. The same goes for any saved home or work addresses in the navigation system. And if you’re in the market for a new vehicle, consider brands with stronger privacy postures — BMW, for example, voluntarily honors data access and deletion requests, while Renault (a European brand bound by GDPR) was rated least problematic by Mozilla.
None of these steps should be necessary. The burden of privacy shouldn’t fall on individuals who just want to drive to the grocery store without being tracked. But until federal privacy legislation catches up to the connected car industry, the dashboard will keep collecting, and the data will keep flowing. Knowing what’s happening is the first move. Taking even a few of the steps above gives you back a measure of control — not perfect, but real.