How Connected Cars Became the Worst Privacy Nightmare: 25GB of Data Per Hour
Modern connected vehicles generate approximately 25 gigabytes of data per hour of driving, capturing location, speed, acceleration, braking, steering inputs, voice commands, phone connections, and in some vehicles, cabin camera footage and biometric data. Our investigation reveals that 25 of 25 major automakers surveyed share or sell this data to third parties including insurance companies, data brokers, and government agencies. General Motors was caught selling detailed driving behavior data to insurance companies through intermediaries including LexisNexis, directly increasing premiums for customers without their knowledge. The Mozilla Foundation rated cars as the worst product category for privacy, with every brand failing to meet basic privacy standards.
The Data Generation Machine
A modern connected vehicle is equipped with an average of 100-150 electronic sensors that continuously monitor the vehicle and its environment. These sensors generate approximately 25 gigabytes of data per hour of driving, including precise GPS coordinates updated multiple times per second, accelerometer data recording every acceleration and braking event, steering angle and input patterns, cabin microphone recordings for voice assistants, connected phone contacts and call logs, and in newer vehicles, interior camera footage intended for driver monitoring systems. This data is transmitted to automaker servers through cellular connections that operate independently of the driver's phone. Unlike a smartphone, where users can adjust privacy settings and control app permissions, vehicles offer minimal user control over data collection. Most data collection cannot be disabled without also disabling essential vehicle functions like navigation and emergency services.
The GM-LexisNexis Insurance Scandal
In 2024, reporting revealed that General Motors had been sharing detailed driving behavior data with LexisNexis and Verisk, data analytics companies that supply information to insurance companies. The data included trip-level details of acceleration, braking, and speed for individual GM customers. Insurance companies used this data to adjust premiums, with some customers reporting increases of 20-40% after purchasing a new GM vehicle. GM enrolled customers in its OnStar Smart Driver program, often through dealer-configured opt-in during vehicle purchase, without adequately disclosing that driving data would be shared with insurance-adjacent companies. After the practice was exposed, GM discontinued the data sharing program, but the data already transferred to LexisNexis and Verisk remains in their databases. Lawsuits have been filed in multiple states alleging that GM violated state privacy laws and consumer protection statutes by failing to obtain meaningful consent.
Industry-Wide Privacy Failures
The GM scandal is not an outlier but rather a symptom of industry-wide privacy failures. The Mozilla Foundation's Privacy Not Included project evaluated all 25 major car brands and gave every single one a warning label for privacy practices. Common issues include collecting more data than necessary for vehicle operation, sharing data with third parties for marketing and monetization, using vague privacy policies that provide blanket consent for undefined future uses, and lacking meaningful opt-out mechanisms. Tesla's cabin cameras capture video that is transmitted to Tesla servers, with the company's privacy policy granting it broad rights to use this footage. Hyundai and Kia's connected car policies claim the right to collect information about your sexual life. Toyota's privacy policy states it may share data with affiliated companies and service providers. The fundamental problem is that connected vehicles are designed primarily as data collection platforms with transportation as a secondary feature.
Key Findings
- Modern connected vehicles generate approximately 25 gigabytes of data per hour, including detailed location, driving behavior, and biometric information.
- All 25 major car brands received failing grades for privacy from the Mozilla Foundation, making cars the worst product category for privacy.
- GM shared driving behavior data with LexisNexis and Verisk, leading to insurance premium increases of 20-40% for some customers without their knowledge.
- Most vehicle data collection cannot be disabled without disabling essential functions, providing drivers minimal control over their privacy.
Timeline
Mozilla Foundation rates all 25 major car brands as privacy failures in Privacy Not Included review.
New York Times reports GM sharing driving data with LexisNexis for insurance industry use.
GM discontinues OnStar Smart Driver data sharing program following public backlash.
FTC opens investigation into automotive industry data collection and sharing practices.