How Data Privacy Laws Affect Connected Cars
The modern vehicle knows a lot more than how fast it is traveling.
Depending on the vehicle and the connected services a customer chooses to use, today's cars and trucks may be capable of processing information involving location, vehicle performance, maintenance needs, driving behavior, navigation, smartphone connections, software versions, diagnostic trouble codes, charging activity, and dozens of other vehicle functions.
That connectivity can be incredibly useful.
A connected Ford can help an owner remotely start the vehicle, check certain vehicle information through an app, receive vehicle-health information, locate a parked vehicle, get software updates, access navigation services, and support other connected features.
But as vehicles become more like computers on wheels, an important question follows:
What happens to all of that data?
That question is receiving increasing attention from consumers, automakers, regulators, lawmakers, insurance companies, technology companies, and dealerships.
Data privacy is no longer only something people think about when using a smartphone or visiting a website.
It is becoming part of vehicle ownership.
At Chuck Anderson Ford in Excelsior Springs, Missouri, we believe customers should be able to enjoy the advantages of connected technology while also understanding the choices available to them.
That includes knowing what types of information a connected vehicle may generate, understanding that privacy laws differ by state, reviewing manufacturer privacy settings, protecting personal information when selling or trading a vehicle, and asking questions when something isn't clear.
Connected vehicles are getting smarter.
The automotive industry has a responsibility to make privacy practices smarter too.
What Is a Connected Car?
A connected vehicle is essentially a vehicle capable of communicating electronically with systems outside the vehicle.
That communication can happen through an embedded cellular modem, Wi-Fi, a connected smartphone, Bluetooth, applications, cloud-based services, or other technology.
If you use an app to remotely start your Ford from inside the house, connectivity helps make that possible.
If your vehicle receives an over-the-air software update, connectivity is involved.
If a navigation service receives real-time traffic information, the vehicle is communicating with an outside system.
If vehicle diagnostics help generate a maintenance alert, connected technology may be involved.
Many customers already use connected-car features every day without necessarily thinking about the technology behind them.
And that is understandable.
Customers buy vehicles because they want transportation, capability, comfort, safety, and convenience.
They should not need a computer-science degree to understand how basic vehicle technology works.
At the same time, as connectivity expands, consumers increasingly want to know what information is being generated and where it goes.
What Kind of Information Can a Connected Vehicle Generate?
Not every connected vehicle collects the same information, and not every category of data is automatically transmitted somewhere else.
That distinction is important.
Vehicles contain large amounts of internal operating information simply because modern computers need that information to make the vehicle function.
The Alliance for Automotive Innovation explains that many onboard computers continuously communicate with one another to operate systems such as braking, acceleration, steering, and crash avoidance. Much of that operational information may remain inside the vehicle rather than being continuously transmitted elsewhere.
Other information can be transmitted when connected services are enabled.
Depending on the vehicle, equipment, account settings, and services involved, connected information could include categories such as:
Vehicle identification information
Mileage
Vehicle diagnostics
Maintenance information
Battery or charging information
Vehicle location
Direction and speed
Driving behavior
Software versions
Infotainment information
Navigation activity
Mobile-device connections
Certain audio or visual data
Vehicle-system performance
Ford's current U.S. Privacy Notice explains that connected Ford and Lincoln vehicles may generate categories including Vehicle Data, Driving Data, Vehicle Location, Audio/Visual information, Media Analytics, and Vehicle Analytics depending on the vehicle's technology, software, connected services, and data-sharing settings.
That does not mean every Ford collects every category all the time.
The specific vehicle matters.
The software matters.
The connected features matter.
And the owner's settings matter.
Why Vehicle Data Can Be Valuable
There are legitimate reasons connected vehicle data exists.
Vehicle-health information can help identify potential maintenance concerns.
Diagnostic information can help support repairs.
Location information may enable navigation, stolen-vehicle assistance, or emergency services.
Data from vehicles can help automakers investigate quality concerns and potentially identify patterns associated with recalls or safety issues.
Connected data can support remote software updates.
Fleet managers may use vehicle information to help maintain commercial vehicles and reduce downtime.
Drivers may use connected apps to check vehicle status without walking outside.
In other words, vehicle data is not inherently bad.
It can create genuine customer value.
The privacy question is not simply:
"Should vehicles collect data?"
The better questions are:
What information is collected?
Why is it being collected?
Is it necessary for the feature being provided?
Who receives it?
How long is it retained?
What control does the customer have?
Those are the questions privacy laws increasingly attempt to address.
Why Location Data Receives Special Attention
Among all the information a connected car may generate, location data is particularly sensitive.
Think about what a detailed history of vehicle locations could potentially reveal.
Where someone lives.
Where they work.
Where their children attend school.
Where they shop.
Where they spend the night.
Medical appointments.
Religious services.
Personal relationships.
Daily routines.
The Federal Trade Commission has specifically identified precise geolocation as sensitive information and has warned companies that unlawful collection, use, or disclosure of connected vehicle information can raise serious privacy concerns.
That is why location information has become one of the central issues in connected-vehicle privacy.
The FTC's first major connected-vehicle enforcement action demonstrates how seriously regulators are treating the issue.
In January 2026, the FTC finalized an order settling allegations that General Motors and OnStar collected and sold precise geolocation and driving-behavior data from millions of vehicles without adequately informing consumers and obtaining proper consent.
Under that order, GM and OnStar face significant restrictions on how certain information can be shared and must provide additional transparency and consumer controls.
The case is important for the entire automotive industry.
It sends a clear message:
Vehicle connectivity does not eliminate traditional expectations surrounding consent, transparency, and responsible data handling.
Federal Privacy Law Is Only Part of the Picture
One reason connected-car privacy can become confusing is that the United States does not currently have one comprehensive federal consumer privacy law that governs every piece of personal data in every industry.
Instead, privacy regulation comes from a combination of:
Federal laws
Federal regulators
State privacy laws
Industry-specific laws
Consumer-protection laws
Contracts and privacy policies
Industry commitments
That means the rights available to a connected-vehicle customer can depend partly on where that customer lives and what company is collecting the information.
The Federal Trade Commission plays an important role nationally.
The FTC can challenge unfair or deceptive business practices under federal law, including certain practices involving sensitive personal information.
Automakers and service providers also have to comply with laws that apply to particular categories of information or business activities.
Then individual states can add additional requirements.
The result is sometimes described as a privacy-law patchwork.
California Has Become Particularly Important
California is one of the most influential states in U.S. privacy regulation.
The California Consumer Privacy Act, commonly called the CCPA, and subsequent privacy regulations provide eligible California residents with significant rights concerning personal information.
Depending on the circumstances, those rights can include the ability to know what information certain businesses collect, request access to information, request deletion or correction in certain situations, and opt out of certain types of selling or sharing.
Connected vehicles have specifically attracted attention from the California Privacy Protection Agency.
In 2023, the agency announced a review of connected-vehicle manufacturers and related technologies, noting that modern vehicles may collect location information, preferences, and other details about people's daily activities.
That review has already produced enforcement activity.
In March 2025, Honda agreed to pay a $632,500 penalty and modify certain privacy practices after the California Privacy Protection Agency alleged violations of the CCPA involving consumer privacy requests and other practices. The investigation arose from the agency's review of connected vehicle manufacturers and related technology.
California privacy regulations have continued evolving as well. New rules concerning cybersecurity audits, risk assessments, automated decision-making technology, and other privacy matters became effective January 1, 2026.
For consumers, the takeaway is straightforward:
Connected-car privacy rules are not static.
They are actively developing.
Other States Are Creating Their Own Privacy Laws
California may receive the most attention, but it is not alone.
A growing number of states have passed comprehensive consumer privacy laws.
Those laws are not identical.
Some provide rights involving access.
Some provide deletion rights.
Some allow correction.
Some regulate targeted advertising.
Some address the sale of personal information.
Some define sensitive data differently.
Thresholds determining which companies are covered can also vary.
For automakers operating nationwide, that creates complexity.
A manufacturer may sell the same model in Missouri, California, Texas, Colorado, Virginia, and dozens of other states while facing different privacy obligations depending on the customer's location.
For customers, it means privacy rights may differ from one state to another.
Ford's current U.S. Privacy Notice reflects that reality by providing state-specific disclosures and privacy rights depending on the customer's state of residency.
This is one reason consumers should review the current privacy notice that applies to their vehicle and location rather than relying on information they may have read several years ago.
Automakers Have Industry Privacy Principles Too
The auto industry has also established voluntary privacy commitments.
In 2014, major automakers developed Consumer Privacy Protection Principles for vehicle technologies and services.
Participating automakers include Ford Motor Company.
The principles address areas such as transparency, consumer choice, data security, data minimization, accountability, and treatment of sensitive categories such as location, driver behavior, and biometric information.
The Alliance for Automotive Innovation says participating manufacturers commit to providing meaningful information about what data is collected and how it is used and to obtaining affirmative consent before using certain sensitive vehicle information for marketing or sharing it with unaffiliated third parties for their own purposes.
Because these companies publicly committed to the principles, the Alliance notes that the commitments can be enforceable under Section 5 of the Federal Trade Commission Act.
Industry principles are not a replacement for privacy law.
But they demonstrate that automakers have recognized connected-car privacy as an important issue for more than a decade.
Ford Connected Vehicle Privacy
For Ford customers, Ford publishes a specific Connected Vehicle Privacy section within its U.S. Privacy Notice.
The current Ford notice explains that what a connected Ford transmits generally depends on factors including:
The connectivity technology installed in the vehicle
The vehicle's software version
Which connected services are enabled
The customer's data-sharing selections
The features being used
Ford says transmitted connected-vehicle information is generally associated with a VIN or another identifier and that those identifiers may be linked with an individual customer.
Ford also explains that certain information may be de-identified and used in a form that cannot reasonably be linked back to the customer.
The important customer takeaway is that connected vehicles have settings.
Those settings are worth understanding.
Customers Can Control Certain Connected Features
Not every vehicle data flow can simply be switched off.
Some information is necessary for the vehicle itself to function safely.
Your braking system cannot stop communicating with other vehicle computers simply because you want additional privacy.
But connected services create more consumer choices.
Ford's privacy information explains that customers may be able to control certain connectivity and data-sharing functions through the vehicle's settings or connected applications.
Changing those settings can affect available services.
For example, disabling the transmission of certain vehicle information could prevent remote features or other connected services from functioning correctly.
That is an important tradeoff.
Privacy controls aren't always a simple on/off decision.
Turning something off can mean losing the service that depends on the data.
Customers should decide which features provide enough value to justify the associated information sharing.
Your Phone Adds Another Privacy Layer
The vehicle manufacturer is not the only company involved in a connected car.
Think about everything you may connect to the vehicle.
Your smartphone.
Apple CarPlay.
Android Auto.
Streaming applications.
Navigation applications.
Wireless carriers.
Music services.
Third-party vehicle applications.
Insurance telematics programs.
Each service may have its own privacy practices.
The Alliance for Automotive Innovation recommends that drivers review not only the vehicle manufacturer's privacy policy but also the policies of mobile-app providers and wireless carriers when those services are connected to the vehicle.
This matters because giving a third-party application permission to access certain information is different from the manufacturer collecting it directly.
Connected-car privacy is really an ecosystem.
The vehicle is one piece.
The phone is another.
Apps are another.
Service providers are another.
Drivers should know which company they are authorizing before sharing sensitive information.
Insurance Adds Another Important Question
Vehicle data can also intersect with insurance.
Some drivers voluntarily participate in usage-based insurance programs.
Those programs may evaluate information such as mileage, braking, acceleration, time of day, or other driving characteristics.
Depending on the program, customers may receive discounts in exchange for sharing information.
That can be worthwhile for some drivers.
But participation should be understood.
The Alliance for Automotive Innovation specifically advises consumers to ask who wants vehicle data and why, noting that insurance companies may seek anything from annual mileage to more detailed driving-behavior information.
The FTC's GM/OnStar case also demonstrated why this area receives scrutiny: regulators alleged driving-behavior and geolocation information was shared with third parties in ways customers were not adequately informed about.
Transparency matters.
Customers should know when driving information could be used to influence something as financially important as an insurance premium.
Dealerships Have Privacy Responsibilities Too
Connected-car privacy does not mean dealerships automatically receive every piece of information generated by a vehicle.
They generally do not.
The manufacturer, applications, service providers, and customer settings determine much of what data exists and where it goes.
But dealerships still handle significant amounts of customer information.
When a dealership arranges financing or leasing, it may handle:
Names
Addresses
Phone numbers
Driver's-license information
Income information
Credit applications
Social Security numbers
Bank information
Insurance information
Other financial data
Federal privacy and information-security requirements apply to this area.
The FTC's Privacy Rule under the Gramm-Leach-Bliley Act applies to auto dealers when they arrange financing or leasing for personal, family, or household use.
The FTC's Safeguards Rule also requires covered dealers to maintain measures designed to protect customer financial information.
This is related to connected-car privacy but technically different.
Your vehicle may generate connected data.
Your dealership may separately maintain financial and customer records.
Both deserve appropriate protection.
Why This Matters at Chuck Anderson Ford
At Chuck Anderson Ford, customers increasingly purchase vehicles containing sophisticated connected technology.
That means our role has to evolve too.
Selling the vehicle isn't enough.
We need to help customers understand the technology they are buying.
That may mean helping a customer understand how to connect the Ford app.
It may mean explaining where vehicle connectivity settings are located.
It may mean helping someone perform a reset.
It may mean answering questions about connected features.
And when questions involve Ford's data collection or privacy policies specifically, we can help direct customers to Ford's current privacy resources rather than guessing.
That last point is important.
A dealership should not pretend it controls data that is actually managed by the manufacturer or a third-party service provider.
Responsible customer service means helping the customer find accurate information.
Privacy When Trading or Selling a Vehicle
One of the most practical connected-car privacy issues occurs when a vehicle changes owners.
Modern infotainment systems may contain:
Phone contacts
Paired-device information
Saved navigation destinations
Home addresses
Garage-door settings
Wi-Fi information
User profiles
Connected accounts
App relationships
Ford specifically recommends performing a Master or Factory Reset before selling or transferring a connected vehicle.
Ford also recommends performing a reset after purchasing or leasing a pre-owned vehicle. Depending on the vehicle's connectivity equipment, customers may additionally need to remove the VIN from associated Ford accounts to fully disconnect the previous relationship.
Deleting an app from your phone alone may not be enough.
This should become as normal as wiping a smartphone before selling it.
At Chuck Anderson Ford, this is an area where dealerships can provide real customer value.
As vehicles become increasingly digital, the delivery and trade-in processes need to become increasingly digital too.
Used-Vehicle Buyers Should Pay Attention Too
Privacy isn't only a new-car issue.
In some ways, it may be even more important with used vehicles.
A pre-owned connected vehicle may previously have belonged to someone who:
Paired several phones.
Saved addresses.
Created driver profiles.
Connected applications.
Registered remote-access services.
The new customer should establish a clean digital starting point.
That means resetting appropriate settings, removing old profiles, pairing new devices, and establishing the new owner's accounts.
The same principle applies when returning a rental vehicle.
If you connect your phone to a rental car, delete your personal information before returning it.
Connected Cars Make Cybersecurity More Important
Privacy and cybersecurity are related but different.
Privacy asks questions such as:
Who is allowed to collect or use my information?
Cybersecurity asks:
How is that information protected from unauthorized access?
A company could theoretically have an appropriate reason to collect information and still fail to protect it adequately.
That is why security requirements are becoming such an important part of privacy regulation.
California's newer regulations include cybersecurity-audit requirements for certain businesses, while federal rules such as the FTC Safeguards Rule require covered dealerships to maintain information-security programs protecting qualifying customer financial information.
Automakers also continue investing heavily in vehicle cybersecurity because modern vehicles rely on increasingly complex software and network connections.
The challenge will continue growing as vehicles become more connected.
Privacy Could Become a Competitive Advantage
There is an interesting possibility developing within the automotive industry.
Privacy may eventually become something customers actively compare between brands.
Consumers already compare:
Horsepower.
Fuel economy.
Towing.
Safety.
Warranty coverage.
Technology.
Infotainment.
Why not privacy?
Customers may increasingly ask:
Can I turn location sharing off?
How easy is it to request my data?
What information does the vehicle collect?
Does the company sell information?
How long is it retained?
Can I delete it?
What happens when I sell the vehicle?
Automakers that make those answers easy to find and understand may earn more trust.
The companies that make privacy confusing may face increasing skepticism.
Transparency itself can become a product feature.
Connected Technology Is Still Worth Having
None of this means customers should be afraid of connected vehicles.
Connected technology provides enormous benefits.
Remote-start functionality is convenient during a Missouri winter.
Vehicle-health alerts can be useful.
Navigation can make travel easier.
Emergency services can improve safety.
Software updates can improve vehicle functionality without requiring a traditional service visit.
Connected diagnostics can support maintenance.
Fleet connectivity can reduce downtime for businesses.
The answer isn't to reject technology.
It is to understand it.
We should expect modern vehicles to become more connected, not less.
Privacy laws exist to help make sure consumer protections evolve along with the technology.
Practical Privacy Tips for Connected-Car Owners
There are several simple steps connected-car owners can take.
Read the manufacturer's current privacy notice.
Review the privacy and connectivity settings inside your vehicle.
Understand what services you have enabled.
Review permissions before connecting third-party applications.
Use strong, unique passwords for vehicle-related accounts.
Protect access to your smartphone.
Consider carefully before enrolling in programs that monitor driving behavior.
Inform other regular drivers that the vehicle has connected features.
Perform the appropriate reset before selling, trading, or returning a connected vehicle.
After purchasing a used connected vehicle, reset previous profiles and establish your own accounts.
And when something is unclear, ask.
You should understand the technology you paid for.
The Future Will Require More Transparency
Connected vehicles are still relatively early in their development.
Future cars and trucks will likely generate and process even more information.
Advanced driver-assistance systems may rely on more cameras and sensors.
Artificial intelligence may personalize vehicle functions.
Predictive maintenance may analyze larger amounts of operating information.
Electric vehicles may communicate more frequently with charging networks.
Vehicles may interact with road infrastructure.
Insurance programs may become more data-driven.
Commercial fleets may use increasingly sophisticated telematics.
Every one of those developments creates potential benefits.
Every one also raises privacy questions.
The regulatory conversation therefore isn't going away.
Federal regulators will continue addressing unfair or deceptive practices.
States will continue developing their own privacy rules.
Automakers will continue adjusting privacy policies.
Consumers will gain greater awareness of what their vehicles are capable of knowing.
And dealerships will increasingly be expected to help customers understand the technology they are purchasing.
Driven by Value Includes Protecting Trust
At Chuck Anderson Ford, we talk frequently about being Driven by Value.
Usually that conversation involves things like:
Competitive vehicle pricing.
Financing.
Trade values.
Service.
Convenience.
Long-term ownership costs.
But there is another type of value that matters just as much.
Trust.
A customer should be comfortable asking how a vehicle works.
They should be comfortable asking what an app does.
They should know how to reset their vehicle before trading it.
They should understand that connected features may involve sharing certain information.
And they deserve accurate answers when privacy questions arise.
As vehicles become more sophisticated, dealerships have to become better educators.
That is how Chuck Anderson Ford intends to adapt.
We don't expect every customer to become a privacy expert.
We do believe customers should have access to the information necessary to make informed choices.
Connected cars are here to stay.
They will continue becoming safer, smarter, more convenient, and more capable.
Privacy laws will continue evolving alongside them.
The challenge for the automotive industry is making sure that progress in connectivity doesn't come at the expense of customer trust.
At Chuck Anderson Ford in Excelsior Springs, that means continuing to learn, continuing to educate, and continuing to help our customers understand the technology inside the vehicles they drive every day.
Better technology should create a better ownership experience.
And protecting customer trust has to be part of that experience.
That's what being Driven by Value means to us.