On the Road to Risk: Connected Cars Put Drivers’ Privacy and Safety in Harm’s Way

Connected car privacy is now a mainstream problem for nearly every driver, with even greater risks for certain populations, like targets of domestic violence (DV). Recent state laws, federal regulatory efforts, and enforcement actions are beginning to address these issues, but there are major gaps in privacy protections that the auto industry and policymakers still need to repair. 

Privacy and Safety Risks in Connected Cars 

Today, vehicles routinely collect and transmit detailed information about driving behavior, location, and in-car functions. Researchers at Northeastern University in partnership with Consumer Reports recently published a study evaluating connected car privacy risks. They tested 21 vehicles and 30 companion mobile apps, finding that 19 out of the 21 vehicles disclosed data about their drivers to third parties and 7 of the 30 companion apps disclosed sensitive personally identifiable information about users to third parties associated with advertising and tracking.   

Connected car data can be misused in contravention of drivers’ expectations, and can pose safety risks, especially in the DV context. Abusers may share ownership of vehicles, and driving data can be weaponized to track or monitor survivors because manufacturers often hesitate to intervene due to joint ownership rights. 

DV survivors face unique privacy and safety risks because abusers can use connected car features to remotely start or lock the car, sound the horn, and use precise location tracking to stalk, harass, or trap intended victims, sometimes even after separation or a protective order. The connectivity that enables these abuses has been documented in court cases and news outlets, highlighting the challenges survivors face in disconnecting abusers from their vehicles.  

Insufficient privacy protections for connected car data threaten all drivers’ privacy and safety by enabling location tracking to sensitive locations like medical clinics or places of worship, and connected car data can even impact insurance premiums.  

State Legislative and Federal Developments 

Several states have now passed targeted connected-car statutes, some with an explicit focus on protecting domestic violence survivors: 

• California has been at the forefront of this effort with several legislative measures. Its Vehicle Code (Cal. Veh. Code §§ 28220, 28222) requires automakers and service providers to promptly terminate remote access to connected vehicle features for qualifying individuals, such as DV survivors who can show legal possession or a qualifying court order. These laws prohibit fees for cutting off access and mandate clear processes and in-vehicle notices when remote technology is active. Additionally, California Senate Bill 1394 (SB 1394), enacted in 2024, expands these protections by requiring manufacturers to implement technology that allows DV survivors to disable remote vehicle access promptly and at no cost. It also mandates clear consumer communication about active connected features and associated risks. Some of the provisions of SB 1394 would have gone into effect July 1, 2026, but California recently passed SB 719, which pushed back the full implementation deadline to January 1, 2028. 

• California’s CPRA regulation § 7012 requires businesses to provide consumers with a notice at collection (or a notice before information collection) disclosing the categories of information being collected, the purposes for which it is used, whether it is sold or shared, and how long it will be retained. The regulation extends these obligations to third parties that collect data within vehicles, for example, a car rental company must give notice at the point of sale, while any third-party collecting data inside the vehicle must provide its own notice, such as through dashboard signage directing consumers to where the notice can be found online.  

• New York’s General Business Law § 399-ccccc, similar to California’s Vehicle Code, obligates manufacturers to disable remote access to connected vehicle functions upon request from qualifying abuse survivors. This law took effect in 2025. 

• New Jersey’s P.L. 2023, Chapter 314 (C.56:12-18.1), enacted in 2024, requires motor vehicle dealers to provide consumers with the ability to delete personal information stored in a vehicle, including navigation history, paired phones, and garage door codes, whenever the dealer takes possession of a vehicle for resale or lease. The deletion must follow National Institute of Standards and Technology (NIST) data sanitization guidelines or manufacturer-specified factory reset procedures. 

• Illinois Public Act 103-0371, enacted in 2024, amends the Collateral Recovery Act to required licensed repossession agencies to clear, erase, or delete any personal information, like biometric data, contacts, garage door codes, and map data, stored in a repossessed vehicle as soon as practicable and before releasing the vehicle from their possession.  

• Oregon HB 3875, effective 2025, expands privacy protections for personal data collected by motor vehicles, requiring automakers to comply with data-controller obligations, and giving consumers rights to delete, access, and prevent the sale of personal data. 

• Utah’s HB 357 S1, effective 2027, amends the Utah Consumer Privacy Act to extend data protection rules to motor vehicle manufacturers handling personal data through in-car systems. It introduces a new “Motor Vehicle Data Privacy” section requiring built-in privacy controls for 2030+ model year vehicles, allowing drivers to view data collection categories, third-party sharing, opt out of sales or ads, and delete accessible data directly via the car’s interface.  

Twenty-three states have also passed general privacy laws that enshrine consumer rights to opt out of certain types of collection, sale, and/or disclosure of their personal data. 

The Department of Commerce Bureau of Industry and Security finalized a rule in 2025 aimed at mitigating national security risks related to connected cars. The rule prohibits vehicle manufacturers from importing vehicles into the US containing certain vehicle connectivity hardware and software developed in China or Russia. Additionally, Senators Bernie Moreno and Elissa Slotkin introduced the Connected Vehicle Security Act of 2026, which would build upon and codify the Department of Commerce’s rules. The bill would restrict the importation, sale, and resale of connected vehicles and parts manufactured or developed in China, Russia, Iran, or North Korea.  

Enforcement and Litigation  

Enforcement actions and private litigation underscore connected car privacy as both a survivor safety and consumer protection issue. State and federal agencies have begun to act, for example: 

• The 2024 Texas Attorney General (AG) filed suit against General Motors and OnStar highlighting unlawful data collection and sale practices affecting over a million Texas residents, exposing granular driving data such as seatbelt use and trip times. 

• More broadly, Texas AG investigations targeted multiple manufacturers for their telematics data handling. 

• In 2025, AGs in Arkansas and Nebraska, as well the Federal Trade Commission (FTC), brought enforcement actions against GM/OnStar. In 2026, the Iowa AG also sued GM. 

• Also in 2025, the Texas AG filed suit against insurance company Allstate and its subsidiary Arity. 

There has also been private litigation, for example: 

• Class action lawsuits have been brought against GM/OnStar/Verisk and Allstate, as well as against Toyota and Progressive for misuse of driver data. 

• A San Francisco domestic violence survivor sued her ex-husband and later added Tesla to the suit, alleging her ex-husband used the connected car features of their Tesla Model X to track and stalk her after the court issued a restraining order. The court dismissed Tesla for lack of evidence that its technology enabled the abuse and the case was ultimately settled in 2023. 

The difficulty of DV survivors to sue car manufacturers for allowing abusers to misuse underscores the urgent need for tailored legal protections against stalking and abuse via vehicle technologies. 

Key Privacy Risks and Policy Gaps 

• Continuous Tracking and Profiling: Connected cars log trips, location, and behavior continuously, often without visible driver notification, compiling sensitive profiles that expose drivers to inherent risks like data breaches or stalking. Opaque data flows intensify these risks, as drivers often lack clear notice or adequate consent mechanisms for data disclosure to insurers, brokers, or third-party companies. 

• Asymmetric Control: Account and app-based features often place unilateral access control in the hands of one driver, who may be an abuser, leaving others powerless to revoke access. Connected car systems rarely incorporate anti-abusability design like physical proximity overrides, data minimization, or persistent visual notification of data collection and disclosure. 

• Limited Protections: Laws focused on DV survivors exist but are state-specific, leaving most drivers without connected-car-specific protections. 

Recommendations for States, Regulators, and Automakers 

• Automakers must build granular, user-friendly access controls allowing authorized drivers to view and manage remote access, plus adopt strict data minimization and opt-out defaults for data transmitting. Regulators should mandate multi-user accounts with independent visibility. Car makers should implement real-time notifications alerting drivers when their data is being accessed or disclosed. User controls like data deletion rights and maximum retention periods mitigate privacy issues. 

• States should enact fast, no-cost remote access termination for survivors and vehicle possessors, as well as mandated in-vehicle and app disclosures of remote features and control holders. 

• Federal regulators, like the FCC, should leverage their full authority to implement baseline privacy, authentication, and revocation tools for survivor safety and broader consumer protection. Along with State AGs, federal regulators should coordinate and pursue enforcement related to unfair or deceptive telematics data practices. 

Conclusion 

Connected car privacy is both a critical domestic violence safety issue and a universal consumer protection challenge. Emerging laws and enforcement actions provide some protections for consumers and DV survivors, but much remains to be done. Coordinated legislative, regulatory, and industry efforts must ensure all drivers, especially survivors, can use connected cars without fear of abuse or exploitation.