You bought a car. You think you own it. You don't. You leased the metal and handed over the rest — your driving habits, your destinations, your weight, your playlist, your sex life if the seat sensors are feeling chatty. The car is a data center that happens to have cupholders, and the data center is for sale.
This isn't hypothetical. Mozilla's 2023 Privacy Not Included investigation looked at 25 car brands and found every single one collecting more personal data than you'd hand to a stranger. Ninety-two percent of them said they can share your information with third parties. Eighty-four percent said they can sell it outright. Nissan's privacy policy at the time went as far as listing "sexual activity" and "sexual orientation" among the categories it might collect. Read that again. Your Rogue might know you better than your therapist, and it's not bound by confidentiality.
The Stepback: how a steering wheel became a snitch
It started quietly. First it was telematics for insurance discounts — drive safely, pay less. Then it was over-the-air updates, which required connectivity. Then it was subscription features and app integrations and voice assistants that needed microphones. Each feature was sold as a convenience. Each one came with a clause in a 40-page agreement that nobody read because you were standing in a dealership at 9 p.m. with a pen and a stomach full of vending machine pretzels.
The result is a rolling surveillance device that knows when you brake, when you speed, when you drive past a planned parenthood, when you park outside a bar at 2 a.m. on a Tuesday. It knows your commute, your kid's school, your affair. And it's transmitting all of it — often over unencrypted connections — to a server farm owned by a company you've never heard of.
"The car is the most invasive product we've ever studied. It's your phone, but it can run you over."
That's not my line. That's a paraphrase of Mozilla's researchers, who spent eight months digging through policies written by lawyers paid to make you stop reading. They found that cars collect biometric data — voiceprints, fingerprints, even facial scans in some models — and that most brands reserve the right to share that data with "business partners." Which is a phrase that means whatever the business partners want it to mean.
The dealership is a data broker with a showroom
Here's the part that should make you angrier than it probably does: the dealer is in on it. When you finance a car, you hand over your Social Security number, your income, your address history. That information doesn't stay in a filing cabinet. It gets piped into marketing systems, sold to lead generators, and bundled into risk models that follow you for years.
Then there's the aftermarket. That dongle your insurance company mailed you — the one that "just tracks mileage" — is often a full telematics unit that logs hard braking, late-night driving, and phone usage. Progressive's Snapshot, Allstate's Drivewise, State Farm's Drive Safe & Save: they all pitch discounts. They all collect far more than they advertise. And they all reserve the right to raise your rates based on what they find.
It's a neat trick. You volunteer to be surveilled because you're told it'll save you money. Then the surveillance is used to charge you more. It's like paying a burglar to case your house.
Why regulators are three laps behind
The legal framework for all this is a patchwork of state laws written before anyone imagined a car could have more processing power than a 2010 laptop. California's CCPA gives you the right to opt out of data sales, but good luck figuring out which of the seven companies in your car's supply chain actually has your data. The FTC has nudged the industry a few times, but it's been mostly wrist slaps and stern letters.
Meanwhile, the EU's GDPR theoretically applies, but enforcement against automakers has been sluggish. In 2024, a German court ruled that Tesla's data collection violated privacy rules, but the penalty was a rounding error for a company that moves billions in revenue. The message is clear: collect everything, apologize later, pay the fine out of petty cash.
And the carmakers? They're not hiding it. They're proud of it. GM's former CEO Mary Barra has talked openly about the company's "data as a service" ambitions. Ford filed a patent for a system that listens to your conversations to serve you ads. Tesla's cabin camera has been used to monitor driver attention — and, according to some reports, to gather footage that ends up in the hands of employees. Your car is not your private space. It's a focus group that you pay to attend.
What you can actually do about it
Not much. That's the honest answer. But you can do something. When you buy a car, ask for the privacy policy in writing before you sign. Demand to know what data is collected, who it's shared with, and how to delete it. Some brands — notably Mercedes and BMW — have made it slightly easier to opt out of certain data collection. Others make it a Kafkaesque obstacle course.
You can also avoid the connected features where possible. Don't activate the in-car Wi-Fi. Don't use the manufacturer's app if you don't have to. Don't plug in the insurance dongle. Treat the infotainment system like a public terminal: assume everything you do on it is being logged.
And then there's the bigger ask: pressure regulators to treat cars like the data-collection platforms they are. The infrastructure exists. The political will doesn't. Automakers spent $70 million lobbying Congress last year. The people who want your data have deeper pockets than the people who want to protect it.
So here's where we are. You can buy a car that knows your every move, or you can buy a used 2005 Corolla with a tape deck and a prayer. The Corolla won't rat you out. But it also won't brake for you, and it definitely won't stream Spotify.
That's the trade. Your convenience for your privacy, one data point at a time. The car isn't selling your data. You already did. You just didn't read the contract.
