In 2025 and 2026, California's Privacy Protection Agency fined three of the largest car manufacturers in the world for violating consumers' privacy rights. The fines tell you everything you need to know about how your car manufacturer views your data.
The largest CCPA fine in history. GM collected driving behavior data from hundreds of thousands of California drivers through OnStar and sold it to LexisNexis and Verisk. These companies packaged the data into "driver rating products" sold to insurance companies. Drivers' insurance premiums increased based on data their cars collected without their meaningful consent. GM did this for four years.
The CPPA found Honda's online privacy-rights request form unlawfully demanded up to eight pieces of personal data for every type of request — including simple opt-outs that don't require identity verification at all — making it harder than the law allows to exercise your rights. Honda also could not produce compliant contracts with the ad-tech vendors it shared driver data with.
Ford required consumers to verify their email address before processing opt-out requests. Consumers who submitted opt-out requests but did not complete the email verification had their requests silently discarded. Ford continued selling their data as if the request had never been made.
If your car was manufactured after 2015 and includes any connected service — OnStar, FordPass, HondaLink, Toyota Connected Services, Blue Link, or similar — it is almost certainly collecting the following data:
This data flows from your car through a cellular modem (the telematics control unit) to the manufacturer's servers. From there, it can be shared with insurance companies, advertising partners, data brokers, law enforcement, and any third party the manufacturer chooses to do business with.
The GM case revealed the data supply chain clearly. Your car's telematics unit sends driving data to GM's servers. GM sold that data to LexisNexis and Verisk — two of the largest data brokers in the country. LexisNexis and Verisk packaged the data into insurance risk scores. Insurance companies used those scores to adjust premiums. Your rates went up because your car reported that you brake too hard or drive too fast — and nobody told you it was happening.
The same data pipeline exists at nearly every major manufacturer. The only question is which third parties they share with and how transparent they are about it.
| Manufacturer | Privacy Request Page | Notes |
|---|---|---|
| Ford | ford.com/help/privacy/ccpa/ | Required email verification (fined for this). Now must process without extra steps. |
| GM / Chevrolet / Buick / GMC / Cadillac | gm.com/consumer-privacy | Also disable OnStar data sharing in vehicle settings. Cancel Smart Driver programs. |
| Honda / Acura | honda.com/privacy/consumer-privacy-request | Disable Driver Feedback in infotainment. Two menus past safety toggles. |
| Toyota / Lexus | toyota.com/support/privacy-rights | Disable Insure Connect and usage-based data sharing. Lawsuit pending over opt-out failures. |
| Hyundai | hyundaiusa.com/us/en/privacy | Disable Blue Link data sharing in app settings. |
| Kia | kia.com/us/en/privacy | Submit privacy request through online portal. |
| Tesla | tesla.com/legal/privacy | Cabin camera, autopilot data, location tracking. Disable in vehicle settings. |
| Nissan / Infiniti | nissanusa.com/privacy | Submit through privacy request form. |
| Subaru | subaru.com/support/consumer-privacy.html | Disable STARLINK connected services data sharing. |
1 Submit a privacy request through your manufacturer's privacy page. Request deletion of all personal data including location history, driving behavior, and any data shared with third parties. Cite your VIN.
2 Disable connected services in your car's infotainment system. Look for settings related to data sharing, driver scoring, usage-based insurance, and location services.
3 Cancel the connected service subscription if you do not need remote start, SOS, or stolen vehicle tracking. The cellular modem in your car cannot transmit data if the subscription is canceled.
4 Check your insurance rate for unexplained increases. If your premiums went up and you have no accidents or tickets, your car's telematics data may have been used against you.
5 Use the Vehicle Privacy Report at vehicleprivacyreport.com to check what data your specific vehicle collects. Enter your VIN and see a detailed breakdown.
Some privacy advocates go further and physically disable or remove the telematics control unit (TCU) — the cellular modem that transmits data from your car. This is the nuclear option that permanently stops data transmission.
Before doing this, understand the tradeoffs. Disabling the TCU will eliminate all connected services including emergency SOS calling, stolen vehicle tracking, remote start, over-the-air software updates, and in some vehicles, navigation. Depending on your vehicle, it may also trigger a dashboard warning light.
This is a personal decision that depends on how much you value connected services versus privacy. For many people, the privacy request and opt-out approach is sufficient. For those who want absolute certainty that no data is leaving their vehicle, the physical disconnection is the only guarantee.
The connected vehicle surveillance problem is getting worse, not better. Federal legislation requires all new vehicles to include advanced impaired driving detection technology by 2027 — technology that will require biometric sensors, cameras, or behavioral monitoring inside the cabin. Ford has filed a patent application (US20250104469A1, submitted September 2023, still pending as of 2026) describing in-cabin cameras and machine learning that could scan faces, read lips, and monitor heart rate — and compare biometric data against law enforcement or security databases, alerting authorized personnel to matches like active warrants or missing persons. Ford says patent filings are a routine part of protecting intellectual property and don't necessarily reflect products it plans to ship.
The privacy fight in the automotive industry is just beginning. California's enforcement actions against GM, Honda, and Ford are the opening moves. As more consumers become aware that their cars are surveillance devices, the demand for vehicle privacy protection will only grow.
Vigilant Privacy sends CCPA deletion requests to car manufacturers on your behalf, citing your VIN. We also target the data brokers your manufacturer shares with — LexisNexis, Verisk, and others. No other privacy service does this. $9.95/month.
Start Your Free 7-Day TrialNo credit card required. Cancel anytime. We never sell your data.