Modern connected cars collect and share extensive driving data, study finds

A joint investigation by researchers at Northeastern University and Consumer Reports examined how modern connected cars function as surveillance platforms, collecting and sharing extensive driving data. The team reviewed thousands of pages of automaker privacy policies and directly contacted 15 major automakers—BMW, Ford, General Motors, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Stellantis, Subaru, Tesla, Toyota, and Volkswagen—to assess their data practices.

The investigation found that while some automakers obtain user consent for data collection, this consent is often obtained through onboarding flows or privacy policy agreements that drivers accept without full understanding. For example, consent forms frequently appear when first turning on a vehicle’s infotainment system or within connected mobile apps, and many users accept these terms without reading them.

Beyond automakers, the data ecosystem includes insurers, lenders, and telematics data exchanges that aggregate driving data on millions of drivers. These exchanges compile data used to generate personalized risk scores, which are then shared with insurance and lending partners. Data brokers in the “insurtech” industry further process this information, creating detailed profiles of driver behavior.

The report also notes that local and state government agencies access this data for planning, traffic management, and safety initiatives. Privacy experts quoted in the investigation describe the monetization of individual driving data as having profit potential comparable to “the new oil,” underscoring the scale and value of this data ecosystem.

The findings illustrate a broader trend where drivers, even as paying customers, are the product due to the extensive surveillance and data-sharing practices embedded in connected vehicle technology.