Connected Car Privacy Depends on Where You Live
Connected Car Privacy Depends on Where You Live, as state laws give Americans unequal protection for the same vehicle data.
That matters because today’s cars can generate precise location information, braking and acceleration records, speed data, navigation history and account details tied to a driver. A vehicle does not stop being a data device when the engine shuts off. It may continue communicating through cellular services, manufacturer apps and cloud accounts.
The result is an awkward American reality: not all drivers are created or treated equally when their cars collect data. Your rights can depend heavily on your ZIP code.
You may also enjoy this: Escape Car Data Tracking: Why 2000–2005 Vehicles Are Booming
You may also like this Video:
Connected Car Privacy Laws Vary by State
State lawmakers have been filling a gap left by the absence of one comprehensive national consumer privacy law. The National Conference of State Legislatures reported that 49 states and the District of Columbia considered more than 800 consumer privacy bills in 2025, with more than 30 states enacting at least 100 new laws.
Those laws are not identical. Some give consumers broad rights to access, correct or delete personal information. Others provide narrower protections, include larger exemptions or rely mainly on state attorneys general for enforcement. Whether a law covers vehicle-generated information can also depend on how the data is categorized and used.
That creates complexity for automakers, but it also creates inequality for drivers. Two owners of the same model may have different options for requesting data, stopping its sale or challenging how it was collected.
Steering wheel. Interior, front part of the modern car.
California Drivers Received Specific Protections
California provides the clearest recent example. In May 2026, state officials announced a proposed $12.75 million settlement with General Motors over allegations that GM sold location and driving-behavior data from hundreds of thousands of Californians to two data brokers without proper notice or consent.
Investigators said the information included names, contact details, precise location and driving behavior. They also found that California drivers were protected from insurance-rate increases tied to the information because state insurance rules prohibit that use. Drivers elsewhere were not necessarily protected in the same way.
That distinction captures the larger problem. The same alleged data practice can carry different financial consequences depending on where the driver lives.
You may also enjoy this: Your Car Knows More Than You Think
Car Tech
Federal Action Helps but Does Not Create Equality
The Federal Trade Commission finalized a separate order involving GM and OnStar in January 2026. The FTC order requires affirmative consent for many connected-vehicle data practices, creates access and deletion rights for U.S. consumers, and bars certain disclosures to consumer reporting agencies for five years.
That order offers meaningful protections, but it resulted from a specific enforcement case. It is not a comprehensive federal connected car privacy law covering every automaker and every driver under one permanent standard.
Congress has considered proposals addressing vehicle data. The Auto Data Privacy and Autonomy Act, introduced in December 2025, would limit manufacturers’ ability to access or share covered vehicle data without consent. As of July 2026, it had not become law.
View through open side electric car window. Man in cap sitting in elite automobile, putting one hand on steering wheel and by other hand entering destination address on large touch screen.
What Drivers Can Do Right Now
Drivers should read the privacy settings in both the vehicle and its companion app. Look for controls involving location, driving behavior, personalized insurance, data sharing and connected-service enrollment. A cheerful button labeled “improve my driving” deserves the same scrutiny as any other data agreement.
Before selling, trading or returning a vehicle, remove paired phones, navigation destinations, garage-door codes and signed-in profiles. A factory reset may clear locally stored information, but it may not delete information retained in a manufacturer’s cloud system. Owners should separately request account deletion when available.
Connected technology can deliver real safety and convenience benefits. Automatic crash response, remote diagnostics and stolen-vehicle assistance all depend on data. The issue is not whether cars should collect anything. It is whether every American receives clear notice, meaningful control and equal protection.
Until Congress creates a consistent national standard, connected car privacy will remain partly determined by state lines. Your car may be identical to your neighbor’s, but your rights surrounding its data may not be.
