Your Car Knows

Documented caseIn 2023, US law enforcement used GM OnStar location data to track and charge a suspect in a murder case, without the suspect knowing their car had reported real-time GPS coordinates. No warrant was required at the time of initial data collection.

Documented caseForensic extraction of Bluetooth logs from a rental car identified all phones connected during the rental period — used in a 2022 criminal investigation to place specific individuals in the vehicle at specific times, without any consent from those individuals.

Documented caseTesla's "Sentry Mode" footage has been subpoenaed in multiple criminal cases. In 2023, a Tesla owner discovered their vehicle had recorded and uploaded footage of nearby protests without their active knowledge, raising questions about consent for ambient recording.

Documented caseA 2023 investigation found that major US EV charging networks were selling location data to data brokers. This data included charging timestamps and precise coordinates, creating a movement history independent of the vehicle manufacturer's systems.

Documented caseMultiple US insurers used telematics data from connected cars to retroactively raise premiums for customers who had not opted into monitoring programmes — the data was obtained via OEM data-sharing agreements the customer never directly consented to.

What's collectedWake-word detection means the microphone monitors continuously before activation. Some manufacturers confirmed that a small percentage of audio clips captured before the wake word are reviewed by human staff for accuracy improvement — without user notification in original privacy policies.

Documented caseWhen a used car is sold, the infotainment system often retains the previous owner's phone contacts, call history, home and work addresses, and linked app accounts. Privacy researchers found this data present in 90%+ of tested used vehicles in 2023 (Mozilla Foundation research).

Documented caseUber and Lyft have both complied with thousands of law enforcement data requests annually, disclosing trip origin/destination, timestamps, and account identity. In some cases, this data was provided without a warrant under emergency disclosure provisions.