Is My Car Spying on Me? We Read Six Carmaker Privacy Notices

The question shows up in the driveway, not in a newsroom. Somebody buys a car with a screen in the middle of the dash, drives it home, taps through a setup wizard, and about four months later gets a renewal notice with a number on it that does not make sense. Then they sit down at the kitchen table and type six words into Google: is my car spying on me.

Here is what makes that a hard question to answer honestly. In January the federal government did something real about it — and almost nothing you will read today mentions that it happened.

That last number is the reason this piece exists. The scary half of this story is everywhere. The useful half is nowhere.

What the FTC actually did in January, and who it left out

The case started with a newspaper. A New York Times investigation reported that GM was collecting detailed driving data through a feature called OnStar Smart Driver — marketed as a coaching tool that would nudge you toward better habits — and passing it to LexisNexis and Verisk, two analytics firms that sell records to insurance companies. GM ended Smart Driver in 2024 and cut its relationships with both firms.

The FTC announced its complaint in January 2025. It alleged that GM used a misleading enrollment process to sign people up, and that it “failed to clearly disclose that it collected consumers’ precise geolocation and driving behavior data via the Smart Driver feature and sold it to third parties without consumers’ consent.”

A year later the Commission finalized the order. The language it used about GM is not the language regulators normally use. The five-year ban, the FTC wrote, is appropriate “given GM’s egregious betrayal of consumers’ trust.”

So far, so good. Now read the first line of the order again, the part nobody quotes: it binds General Motors LLC, General Motors Holdings LLC, and OnStar, LLC.

That is the whole list.

This is not a loophole and it is not a scandal. It is just how enforcement works: the FTC sued a company, the company settled, the settlement binds that company. But it produces a result most drivers would never guess. If you drive a Chevrolet, a federal order now stands between your braking data and an insurance data broker until 2031. If you drive the same model year from any other manufacturer, nothing does. There is no federal privacy law that fills the gap.

Which means the honest version of “is my car spying on me” is not a yes or a no. It is: what did your particular carmaker promise, in writing, and where did it write it down?

“Driving Data,” in a carmaker’s own words

Most coverage of this topic describes car data in the abstract — sensors, gigabytes per hour, the car as a smartphone on wheels. That is true and it is useless. You cannot act on a gigabyte.

So here is a definition written by a carmaker, about its own vehicles, which you can read in full today. Toyota’s connected-services notice says:

“We collect your driving behavior data (‘Driving Data’) which includes the acceleration and speed at which your vehicle is driven, travel direction, use of the steering and braking functionality in your vehicle, and vehicle operation data (e.g., sensor readings).”

Read that list slowly. Acceleration. Speed. Direction. Steering. Braking. That is not a record of where you went. It is a record of how you drive, which is the thing an insurer prices.

Volkswagen goes one step further and publishes the scoring logic. Its DriveView feature, it says, produces “a score based on certain factors that are considered higher indicators of risk of collision, such as hard braking, nighttime driving, idle time and high speed.”

Nighttime driving. Not unsafe driving — nighttime driving. If you work a second shift, or you are the one in the family who drives the airport run at 5 a.m., a system somewhere has an opinion about that.

One step deeper: the policy you find is not the policy that governs your car

This is the finding that surprised us, and it is the reason a diligent reader can do everything right and still end up misinformed.

Suppose you do the responsible thing. You search “Toyota privacy policy,” you open the official page, you read it. Here is what it tells you, in a short paragraph most people would skim past:

“Vehicle Generated Data. This Privacy Notice does not apply to any vehicle-generated data (such as driving behavior data and vehicle health data).”

The document you found is not the document about your car. The rules for your car live somewhere else, at a separate address.

Kia does the same thing:

“This Privacy Policy does not apply to information collected using in-vehicle technologies and related services, including online and mobile services that connect to or collect information from your Kia vehicle; a different privacy policy may apply to such…”

Two of the six notices we read on September 7 open by excusing themselves from the only subject you came for. That is not deception — both sentences are right there in the open, and both point you onward. But it means the ordinary act of “reading the privacy policy” reliably produces the wrong answer, and nobody warns you.

And when you do find the second document, the news is often better than the headlines suggest. Toyota’s connected-services notice says: “Unless we obtain your consent, we will not provide your Driving Data to other parties for their own purposes.” Sharing with insurers, it says, happens only “if you provide express prior consent.” Volkswagen lets you unenroll from DriveView in the myVW app or by calling 1-833-648-2735, and says that once you do, “your driving data will no longer be shared with insurance-related companies.”

That is the part the genre gets wrong. The problem in 2026 is not usually a secret sale. It is a consent you gave in a setup wizard on the day you were excited about a new car, recorded in a document you were never going to find.

What page one leaves out

We fetched the pages that rank for this question and searched each one. Ten were candidates; eight rendered readable text. Here is what those eight contain.

Zero of eight mention the January 14 order. Zero mention the five-year ban. Zero note that the order covers GM alone. Zero say that a carmaker’s main privacy notice may exclude the car. And zero — not one — name the Fair Credit Reporting Act.

Three of them do name LexisNexis, which is the interesting near-miss. They tell you the company exists and that it received driving data. They stop one sentence short of the sentence that would help you.

The free file almost nobody asks for

Here is that sentence.

LexisNexis Risk Solutions is not just a data company. For this purpose it is a consumer reporting agency — the Consumer Financial Protection Bureau lists its C.L.U.E. and Telematics OnDemand products among the consumer reporting companies people can request files from. That classification is the whole game, because it drags the company inside the Fair Credit Reporting Act.

Under the FCRA, as published on LexisNexis’s own consumer site: “all consumers are entitled to one free disclosure every 12 months upon request from each nationwide credit bureau and from nationwide specialty consumer reporting agencies.” You are also entitled to a free file any time someone has taken adverse action against you because of information in it — which is to say, any time you were turned down or charged more.

Most people never do this, because nobody tells them it is available. Eight pages of search results on the exact question, and the count was zero.

What to do with this tonight

1. Look up your own VIN. Privacy4Cars runs a free lookup at vehicleprivacyreport.com that reports what your specific year, make and model is documented to collect. Two of the eight pages we scored mention it; it takes about a minute.
2. Open your brand’s connected-services settings — in the car’s screen and in the phone app, because they are not always the same list. Look for anything named driving score, driver feedback, usage-based insurance, or data sharing. Volkswagen owners can unenroll from DriveView in the myVW app or at 1-833-648-2735.
3. Request your LexisNexis file. Free once every twelve months, free again if you were charged more. This is the only step that shows you evidence instead of theory.
4. If something in the file is wrong, dispute it in writing. The agency has to run a reasonable investigation at no cost to you.

One honest caveat about step two: turning off a driving-score feature is not the same as turning off the modem. Cars keep transmitting some diagnostic and safety telemetry regardless, and no setting on the dash changes that. What you are switching off is the pipe that carries behavioral data outward.

If you want to go deeper

Does the FTC order mean GM drivers are safe now? Safer, and specifically so. Until 2031 GM cannot disclose geolocation or driver-behavior data to consumer reporting agencies, and for twenty years it needs your affirmative express consent to collect or share connected-vehicle data at all — with narrow exceptions such as giving location to emergency responders. The order also requires GM to let U.S. drivers obtain and delete their data, and to provide a way to opt out of collection.

Why does this feel like the smart-TV story? Because it is the same business model in a different box. A television earns its keep after the sale by watching what you watch; we walked through where those switches live in how to turn off AI on my TV. A car earns its keep after the sale by watching how you drive. In both cases the device is not malfunctioning. It is working.

Is any of this actually AI? The collection is not — it is sensors and a modem. The scoring is: turning braking events and hours-of-day into a single risk number is a model making a judgment about you, and the same logic that sets one person’s price differently from another’s is the subject of our piece on whether it is legal to charge different prices for the same product.

Nothing here is insurance or legal advice. If you believe a report contains an error that cost you money, your state’s department of insurance takes complaints, and the CFPB accepts complaints about consumer reporting agencies.

Frequently asked questions

Is my car spying on me?

If it was built in the last decade and has a connected-services feature, it is recording how you drive — acceleration, speed, direction, steering and braking, in the manufacturer’s own words. Whether any of that leaves the car depends on your brand and on consents you may have given at setup. Since January 14, 2026, one automaker’s answer is set by federal order; everyone else’s is set by their own policy.

How do I know if my car is spying on me?

Three checks, in this order: run your VIN through the free lookup at vehicleprivacyreport.com; open the connected-services section in both the dashboard and the phone app and read every toggle; then request your free LexisNexis file to see whether anything actually reached an insurer. The third check is the only one that produces evidence.

Does my car sell my data?

“Sell” is the wrong word for most brands today, and that is what makes this confusing. Toyota’s notice says it will not provide Driving Data to other parties for their own purposes “unless we obtain your consent,” and shares with insurers only on “express prior consent.” The realistic risk is not a secret sale — it is consent collected during setup and recorded in a document you never saw.

What data does my car collect?

Toyota’s connected-services notice defines Driving Data as “the acceleration and speed at which your vehicle is driven, travel direction, use of the steering and braking functionality in your vehicle, and vehicle operation data.” Separately, most brands collect precise location, vehicle health and diagnostics, and profile data such as saved destinations and paired accounts.

Is my new car spying on me more than my old one?

Generally yes, for a boring reason: the newer the car, the more likely it shipped with an always-on cellular modem and a connected-services trial switched on at delivery. Older vehicles may record data in the event data recorder but have no way to send it anywhere without a plug-in device.

Why did my car insurance go up for no reason?

There are many ordinary explanations — local claim costs, repair inflation, a change in the household. But if you want to rule out driving data specifically, stop guessing and get the file: LexisNexis must provide it free once every twelve months, and free any time you were charged more because of what is in it. Call 1-800-456-6004 or use the online form.

Can I turn off my car’s data collection completely?

Not completely. You can usually switch off behavioral sharing, driving scores and usage-based insurance programs, and you can unenroll from connected services entirely at most brands. Some diagnostic and safety telemetry continues regardless, and no dashboard setting stops it.

Does the FTC order cover my car?

Only if it is a GM vehicle using OnStar. The order names General Motors LLC, General Motors Holdings LLC, and OnStar, LLC. If you drive anything else, no federal order or federal privacy law governs what your carmaker does with your driving data — only that company’s own published policy does.

Sources

• Federal Trade Commission, “FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers’ Informed Consent,” January 14, 2026.
• Federal Trade Commission, “FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data Without Consent,” January 2025.
• Toyota, Privacy Notice and Connected Services / Vehicle Data Notice, read September 7, 2026.
• Volkswagen, Privacy Statement, section 12 (DriveView and insurance-related data sharing), read September 7, 2026.
• Kia, Privacy Policy; Nissan, Privacy Policy; General Motors, Privacy Statement, all read September 7, 2026.
• LexisNexis Risk Solutions Consumer Disclosure, Your FCRA Rights and request form, read September 7, 2026.
• Privacy4Cars, Vehicle Privacy Report.

Keep reading

• How to turn off AI on my TV — the same business model, in the living room.
• How do I get rid of AI on my phone — twelve places it hides, with the switches.
• How to tell if Meta glasses are recording — when the device watching you belongs to someone else.
• Is it illegal to charge different prices for the same product? — what the law says about pricing you individually.
• Are deleted ChatGPT chats really deleted? — the retention question, asked of a different company.
• How to stop Meta AI from using my photos on Facebook.
• How to stop AI from reading my Gmail, and whether Copilot has access to my emails.
• AI Scam Watch: September 2026, plus how to tell if a phone call is AI and how to tell if a Facebook ad is fake.
• Why is my doctor recording my appointment? — consent you gave without noticing, in a different room.
• Is my electric bill going up because of AI? and the real monthly cost of AI.
• Why am I being charged for Google AI Pro?, do I have to pay for Apple Intelligence?, and can you get Alexa+ without Prime?
• How to turn off Alexa+ ads on Echo Show and how do I talk to a real person.
• Riding a robotaxi from the Las Vegas airport — the car that drives itself, and what it records.
• How to tell if a picture is AI generated.
• More from The Briefing, our AI Price Tracker, and the AI Jobs Tracker.

Written by Prof. H, who teaches robotics and AI and reads the primary documents so you do not have to. Figures in this piece were counted from the sources listed above on September 7, 2026. Last verified: September 7, 2026.