Data collected by cars and sold to third parties

Car insurers can no longer use your driving data sold by automakers to increase your rates.

The Federal Trade Commission (FTC) imposed a five-year ban on General Motors (GM) for selling customer driving data to third-party brokers like LexisNexis and Verisk. These brokers used the data to create risk profiles for insurance companies, potentially leading to increased rates for drivers who were often unaware of the extent of data collection. GM collected data on driving habits, such as speeding frequency and nighttime driving, primarily through its OnStar connected services feature, Smart Driver. Following a New York Times investigation and the FTC's penalty, GM must now simplify the process for drivers to disable location tracking and access or delete their collected data. A Mozilla Foundation study found all major car companies have "horrible privacy and security" practices, with complex, overlapping policies making it difficult for consumers to understand data collection. Consumer Reports corroborated these findings, indicating nearly every automaker sells driver behavior data.

The FTC's action against GM, alongside findings from the Mozilla Foundation and Consumer Reports, highlights a widespread industry practice of aggressive data collection and monetization by automakers. This scrutiny suggests a potential shift towards greater regulatory oversight and consumer awareness regarding vehicle data privacy, though current legislative efforts like the DRIVER Act may not fully address privacy advocates' concerns about data minimization. The incentive for automakers to continue collecting data remains strong due to its value in the broader data economy, creating a persistent tension between corporate interests and consumer privacy.

Consumers' demand for simpler, less data-hungry vehicles is growing, as evidenced by interest in concepts like the Slate Truck. Automakers face a dilemma: continue profiting from data sales or cater to a segment of the market seeking more privacy, which could involve significant business model adjustments. Future developments will likely involve a push-and-pull between industry resistance to abandon lucrative data streams and increasing consumer and regulatory pressure for more transparent and privacy-respecting data handling.