A modern car can produce a behavioral log while doing the ordinary job of being a car.
Location, speed, hard braking, acceleration, trip timing, mileage, diagnostics, and other telemetry can support navigation, maintenance, emergency response, theft recovery, driver coaching, and remote features.
Those are real uses.
The same records can also become commercially valuable somewhere else.
GM and OnStar turned this into a documented enforcement case
In January 2026, the Federal Trade Commission finalized an order with General Motors and OnStar settling allegations that they collected, used, and sold precise geolocation and driving-behavior data from millions of vehicles without adequately notifying consumers and obtaining affirmative consent.
The FTC said the Smart Driver program collected information including hard braking, late-night driving, speeding, and precise location. According to the agency, some of that information was sold to consumer-reporting agencies whose reports were then used by insurance companies in decisions about rates and coverage.
See the FTC’s 2026 final order announcement and the agency’s 2025 original action.
The finalized order restricts certain disclosures to consumer-reporting agencies and requires additional transparency and choice.
Service telemetry and behavioral scoring are not the same thing
A car manufacturer needs some information to deliver connected services.
An emergency system cannot send help without knowing where the vehicle is. A maintenance system needs diagnostic data to identify a failing component.
But the fact that data is useful for the requested service does not automatically answer whether the same record should be used for another purpose.
A driver’s expectation can change sharply when the data moves from:
Your car detected hard braking
to:
Another company added that event to a profile used in an insurance decision.
That is the secondary-use problem in one sentence.
A vehicle can become a sensor platform
Precise location can reveal repeated destinations and routines. Driving events can describe style and timing. Diagnostic systems can reveal vehicle condition. Connected accounts can tie those observations to a named customer.
But an investigation still needs discipline.
The presence of telemetry does not prove every field is sold.
A privacy policy naming broad categories does not prove a particular recipient received a particular trip.
Strong evidence comes from data-flow documentation, contracts, regulator findings, access records, disclosed recipients, or actual reports showing how the telemetry moved.
Connected cars make the Surveillance Economy unusually physical.
The behavioral profile is no longer assembled only from clicks.
Sometimes it starts when you press the brake pedal.