You buy a car.
You make the payments.
The title has your name on it.
It sits in your driveway.
It seems obvious that the car belongs to you.
But every time you drive it, the vehicle may generate something much harder to own.
Data.
A modern connected vehicle can potentially record or transmit information about its location, operation, diagnostics and the way it is being driven. Depending on the vehicle and services involved, information can include speed, hard braking, acceleration, location and other telematics data.
Phones connect to infotainment systems.
Navigation systems remember destinations.
Cameras and sensors monitor the environment around the vehicle.
Remote applications communicate with the car.
Emergency systems can determine where it is after a collision.
The California Privacy Protection Agency has described modern connected vehicles as effectively computers on wheels, noting that built-in applications, sensors and cameras can collect information about people both inside and around them.
That creates a question that would have sounded strange when automobiles were primarily mechanical machines:
If you own the car, how much control do you have over the information the car creates?
The Car Became a Computer Gradually
There was no single moment when automobiles became data-generating devices.
The transformation happened feature by feature.
Electronic engine controls improved performance.
Event data recorders preserved information associated with crashes.
GPS made navigation easier.
Bluetooth connected phones.
Cellular connections enabled emergency assistance.
Applications allowed owners to remotely start vehicles or check their status.
Manufacturers began delivering software updates.
Cameras and sensors supported increasingly sophisticated driver-assistance systems.
Each feature offered a benefit.
Together, they created an automobile that can generate an enormous amount of information.
The car did not stop being transportation.
It became transportation combined with computing, communications and sensing.
Not All Vehicle Data Is the Same
The phrase “car data” can hide important differences.
Some information concerns the vehicle itself.
Engine temperature.
Battery condition.
Diagnostic trouble codes.
Tire pressure.
Maintenance information.
Other information can reveal much more about the person driving it.
Location.
Speed.
Acceleration.
Hard braking.
Time of travel.
Routes.
Connected-device information.
Depending on the vehicle and system, still other information may come from cameras, microphones, applications or services connected to the vehicle.
The Federal Trade Commission has specifically identified biometric information, telematics, geolocation, video and other personal information among the categories that connected vehicles can potentially collect.
Those categories do not carry the same privacy implications.
Knowing that an engine produced a particular diagnostic code is very different from knowing where the vehicle was at 11:43 p.m.
Location Data Can Become a Record of a Person's Life
A car's location seems simple when viewed one point at a time.
At 8:03 a.m., the vehicle was on one road.
At 8:17, it was somewhere else.
But continuous location information can reveal patterns.
Where someone sleeps.
Where someone works.
Which school the person's children attend.
Which businesses the person visits.
How often someone goes somewhere.
Where the vehicle spends the night.
The FTC has emphasized the sensitivity of precise vehicle location information, observing that persistent geolocation can reveal intimate details of a person's daily life.
A navigation feature designed to answer “Where am I?” can therefore participate in creating a much larger record:
Where have I been?
Driving Behavior Can Become Data Too
Location is only part of the story.
A connected vehicle can potentially record how it is being driven.
Speeding.
Hard acceleration.
Hard braking.
Time of day.
Distance.
Other driving characteristics.
This information can have legitimate uses.
A driver might want feedback about driving habits.
A parent might want information about a vehicle used by a teenager.
A fleet operator may need to manage company vehicles.
An insurer may offer a voluntary telematics program in exchange for a potentially different premium.
But the consequences change when information collected for one perceived purpose begins affecting another part of someone's life.
A major federal enforcement case demonstrated exactly how significant that distinction can become.
The General Motors Case Turned Car Data Into a National Privacy Issue
In January 2025, the Federal Trade Commission announced an enforcement action against General Motors and OnStar involving connected-vehicle data.
According to the FTC's complaint, GM collected precise geolocation and driving-behavior information through connected services, including its Smart Driver feature, and disclosed information to third parties, including consumer reporting agencies, without adequate notice and affirmative consent.
The FTC alleged that information could include events such as hard braking, speeding and late-night driving and that consumer reporting agencies used information supplied by GM in reports used by insurance companies.
The allegations demonstrated that vehicle data was no longer merely a theoretical privacy issue.
Information generated during ordinary driving could have financial consequences outside the vehicle.
Some Drivers Discovered the Data Through Their Insurance
The FTC alleged that some consumers became aware of the practices after their driving information affected insurance.
According to the agency's complaint, consumers reported unexpected premium increases and, in some cases, loss of insurance.
The FTC alleged that some consumers did not understand that the connected feature they had joined could result in their driving behavior being disclosed to third parties.
That sequence illustrates the central problem with secondary uses of data.
A driver may understand:
My car is monitoring my driving so I can see information about my habits.
That does not necessarily mean the driver understands:
This information may travel outside the vehicle ecosystem and influence a financial decision about me.
The same data can feel completely different when its purpose changes.
The FTC Ultimately Imposed Long-Term Restrictions
In January 2026, the FTC finalized its order resolving the allegations against GM and OnStar.
Under the final order, GM is prohibited for five years from disclosing certain geolocation and driver-behavior information to consumer reporting agencies.
For the 20-year duration of the order, the companies are also subject to requirements involving affirmative express consent, access and deletion requests, and consumer controls over certain connected-vehicle data. The order includes limited exceptions, including circumstances involving emergency first responders.
The case was the FTC's first connected-vehicle data enforcement action.
Its significance reaches beyond one manufacturer.
It demonstrates that the legal rules governing automobiles increasingly concern information practices as well as mechanical safety.
Owning the Car Does Not Automatically Mean Owning Every Database Record
This is where the ordinary concept of ownership begins to break down.
A person owns a vehicle.
But information involving that vehicle may exist in many places.
Inside the car.
On the driver's phone.
On a manufacturer's servers.
Inside an application.
With a service provider.
With an insurer.
With another company receiving information from one of those sources.
There may not be one master file called “your car data.”
Instead, different entities can possess different records created through different relationships.
The question therefore is often not simply:
Who owns the data?
A more useful set of questions is:
Who collected it?
Who possesses it?
Why was it collected?
What did the consumer agree to?
Who can receive it?
How long can it be retained?
What rights does the consumer have under applicable law?
Privacy Law Often Focuses on Rights Rather Than Absolute Ownership
People naturally talk about personal information in terms of ownership.
“My data.”
But privacy law often operates differently from ordinary property law.
If you own a physical object, you generally have powerful rights to exclude other people from possessing it.
Personal information can exist simultaneously in many places.
A dealership can have your contact information.
An insurer can have it too.
A manufacturer can maintain an account.
A repair shop can retain service records.
The law therefore frequently focuses on collection, disclosure, access, deletion and consent rather than trying to declare one person the exclusive owner of every copy of information.
This distinction is particularly important for connected vehicles.
The driver can be the subject of the data without being the only entity legally capable of possessing a record containing it.
California Began Examining Connected Vehicles Directly
In 2023, California's privacy regulator announced an enforcement review focused on connected vehicles and related technologies.
The agency specifically pointed to vehicle features involving location sharing, internet-connected entertainment, smartphone integration and cameras.
It said connected vehicles could automatically collect locations, preferences and information about consumers' daily lives.
The enforcement initiative was notable because it treated the automobile industry as part of the broader data economy.
Privacy regulation was no longer focused only on websites, advertising networks and smartphone applications.
The car itself had become a privacy platform.
Honda Became Part of California's Connected-Vehicle Enforcement
In March 2025, California's privacy regulator announced a settlement with American Honda Motor Co. arising from its broader review of connected-vehicle manufacturers and related technologies.
The agency alleged several violations of California privacy law, including problems with processes for exercising privacy rights and the sharing of consumers' personal information with advertising-technology companies without contracts containing required privacy protections.
Honda agreed to change certain practices and pay a $632,500 administrative fine.
The enforcement action was not a declaration that collecting vehicle information is inherently unlawful.
Rather, it showed that established consumer privacy requirements can follow companies into the connected-car environment.
Your Phone Can Add Another Layer of Information
A vehicle does not operate in isolation.
Drivers routinely connect phones to cars.
The connection may enable calling.
Messaging.
Navigation.
Music.
Contacts.
Applications.
A rental car can temporarily become connected to a traveler's digital life.
That creates a different kind of privacy issue.
The information involved may not have originated with the vehicle at all.
The car becomes a temporary repository or interface for information from another device.
This is one reason privacy agencies have advised consumers to think about personal information stored in vehicles when selling or returning them.
A modern car can require a digital cleanup much like a phone or computer.
Selling a Car Is No Longer Just Handing Over the Keys
Consider what happens when someone sells a connected vehicle.
The owner removes personal belongings.
Sunglasses.
Garage remote.
Registration papers.
Charging cables.
But what about the digital information?
Saved destinations may remain.
A phone may still be paired.
Contacts may have synchronized.
A home address may be stored in navigation.
Applications may remain logged in.
Remote vehicle access may still be associated with an account.
A new owner should not inherit the previous owner's digital life merely because the physical vehicle changed hands.
The rise of connected vehicles therefore creates a new version of an old responsibility:
Before transferring the property, the owner may need to remove personal information from it.
Rental Cars Create the Same Problem on a Shorter Timeline
A rental vehicle might be used for only three days.
During that time, a driver connects a phone.
Makes calls.
Uses navigation.
Searches for destinations.
Streams media.
Then the vehicle is returned and handed to another customer.
The temporary nature of the relationship makes data retention particularly important.
People are accustomed to cleaning out a hotel room before leaving.
They may be less accustomed to thinking about what information they leave behind in a rented dashboard.
Connected vehicles make that a practical privacy issue.
Cars Can Generate Evidence After a Crash
Not all vehicle data is primarily about privacy.
Some of it can become important evidence.
Event data recorders can preserve information associated with crashes.
Vehicle systems may help reconstruct speed, braking or other conditions.
Navigation information can help establish location.
Connected services may contain records relevant to timing.
When a serious collision results in litigation or criminal investigation, information generated by the vehicle can help reconstruct events that happened in seconds.
This creates another tension.
The same information a driver considers private can be extremely valuable when determining what actually happened.
A Car Can Become a Witness Without Having Seen the Entire Event
Suppose two drivers disagree about a collision.
One says:
“I was traveling normally when the other vehicle suddenly crossed in front of me.”
The other tells a different story.
The vehicle may contain information capable of testing parts of those accounts.
But machine-generated data has limitations.
A record showing speed does not necessarily explain why the vehicle was traveling at that speed.
A braking event does not necessarily establish what the driver saw.
Location data does not necessarily establish who was driving.
The vehicle records conditions.
Humans still have to interpret what those conditions mean.
The Driver and the Vehicle Owner May Be Different People
This creates another complication in discussing “your” car data.
A parent owns a vehicle used by a child.
A company owns a vehicle driven by an employee.
A rental company owns a vehicle driven by hundreds of customers.
A married couple shares a car.
A rideshare driver transports passengers.
Whose data is being generated?
The owner?
The driver?
The passenger?
Potentially information concerning several people can exist within the same vehicle ecosystem.
Ownership of the machine therefore does not necessarily identify the only person with a privacy interest in the information it creates.
Passengers Can Be Part of the Data Story Too
Some modern vehicles contain interior cameras or sensors.
Phones belonging to passengers may interact with vehicle systems.
Voice assistants can potentially receive commands from anyone inside the cabin.
Connected features can therefore implicate people who never purchased the vehicle and never agreed to the manufacturer's terms themselves.
The problem resembles smart-home technology.
One person buys the device.
Other people enter the environment.
The technology can potentially collect information involving all of them.
The owner of the sensor and the subject of the information are not necessarily the same person.
Insurance Shows Why Data Purpose Matters
Telematics can make insurance pricing more individualized.
Traditional auto insurance relies heavily on characteristics that predict risk across groups.
Driving data can potentially allow insurers to consider actual behavior.
Someone who drives carefully and infrequently may welcome that possibility.
Another driver may strongly object to continuous monitoring.
The important issue is therefore not simply whether telematics is good or bad.
It is whether consumers understand what is being collected and how it can be used.
A driver who voluntarily enrolls in an insurance program specifically designed to monitor driving behavior occupies a very different position from a driver who believes vehicle information is being collected for an unrelated connected-car feature.
Consent depends heavily on context.
A Data Point Can Change Meaning When Combined With Other Data
Consider a single record:
The car was at a particular location at 2:15 p.m.
That may reveal almost nothing.
Now combine it with hundreds of thousands of records.
The car is at the same address every night.
It travels to another location every weekday morning.
It regularly visits a third location.
It spends every Tuesday evening somewhere else.
Patterns emerge.
This is a recurring feature of digital privacy.
The sensitivity of a dataset is not always obvious from one record.
The meaning comes from aggregation.
A car can create a behavioral history simply by producing ordinary operational records over time.
Deleting Information From the Dashboard May Not Delete Information Elsewhere
A driver clears the navigation history.
Unpairs the phone.
Resets the infotainment system.
That can be useful.
But information previously transmitted to a remote service may still exist outside the vehicle.
This is another reason connected-car privacy cannot be understood by looking only at the physical automobile.
There may be local data and remote data.
Deleting one does not necessarily delete the other.
Consumer rights to access or delete remotely held information depend on applicable laws, the business involved and the type of information.
California Has Expanded Mechanisms for Controlling Personal Data
California's privacy framework gives covered consumers rights involving certain personal information, including rights that can concern access, deletion, correction, and opting out of particular sale or sharing practices, subject to statutory exceptions and the law's applicability requirements.
California has also continued expanding its privacy regulatory system. Regulations approved in 2025 and effective beginning in 2026 include requirements concerning risk assessments, cybersecurity audits and certain automated decisionmaking technologies.
The state has separately implemented a system known as DROP for deletion requests directed at registered data brokers.
Those developments do not mean every piece of vehicle information can always be deleted on demand.
They illustrate a broader shift toward giving consumers more control over information circulating through complex data ecosystems.
Vehicle Data Will Become More Valuable as Cars Become More Automated
The amount of information generated by vehicles is unlikely to decrease.
Advanced driver-assistance systems depend on sensors.
Electric vehicles rely heavily on software.
Remote diagnostics can identify problems before a driver visits a repair shop.
Connected navigation can respond to changing traffic.
Vehicles can receive software updates remotely.
More automated driving requires machines to continuously understand their surroundings.
Each technological improvement can produce or require more information.
The privacy question therefore is not likely to disappear through better engineering.
Better engineering may create even more data.
The Automobile Is Becoming One of the Most Information-Rich Things People Own
A phone obviously looks like a computing device.
A laptop does too.
A car can hide its computational nature behind a steering wheel and four tires.
But modern vehicles increasingly occupy the same connected environment.
They communicate.
Store information.
Receive updates.
Run software.
Interact with applications.
Generate records.
Connect to remote services.
And unlike a phone, the vehicle physically transports its user through the world.
That makes its data uniquely revealing.
The car does not merely know what someone searched for.
It can potentially know where the machine itself traveled.
The Fight Is Not Really About Who Owns Ones and Zeros
The phrase “Who owns your car data?” makes for an appealing question.
The emerging legal reality is more complicated.
There may never be one universal owner of every piece of information generated by a vehicle.
Instead, the enduring questions concern control.
Who may collect the information?
What must the driver be told?
When is consent required?
Who can receive the information?
Can it affect insurance or other decisions?
How long can it remain?
Can the consumer obtain a copy?
Can the consumer request deletion?
Can collection be disabled?
Those questions are already producing regulatory investigations and enforcement actions.
And they will become more important as automobiles generate increasingly detailed records of their operation and occupants.
For more than a century, buying a car meant acquiring a machine.
Today, it can also mean entering a relationship with a network of software, sensors, servers and companies capable of learning from every mile the machine travels.
You may own the car in your driveway. The much harder question is who controls the digital trail it leaves behind.