How to Actually Opt Out of Car Data Collection

What Your Car Actually Collects

You didn't sign a contract. You bought a car. But somewhere between the dealership finance office and the first drive home, your car started collecting more than 100 different data points. The Mozilla Foundation tested 25 car brands in September 2023 and gave every single one its "Privacy Not Included" warning label. Cars became the worst product category Mozilla has ever reviewed, beating out sex toys, mental health apps, and smart home devices.

The data falls into a few buckets:

Driving behavior

• GPS location history: everywhere you've been, when, how long you stayed
• Speed, acceleration, hard braking events: logged per trip, often per minute
• Time of day patterns: when you commute, when you're home, when you're away
• Mileage and odometer readings: pushed over the cellular modem

Vehicle diagnostics

• Tire pressure, engine status, battery health
• Service intervals and recall tracking
• Crash data (event recorders capture the seconds before impact)

Phone and infotainment

• Contact lists, call logs, text message content (older systems)
• Connected Bluetooth device IDs
• Voice command recordings
• Browsing history from in-car WiFi hotspots

Cabin monitoring (2018 and newer)

• Driver attention cameras (eye tracking)
• Cabin microphones (always-on in some Tesla configurations)
• Weight sensors in seats

Your car's privacy policy will tell you it collects "vehicle health data" and "telematics." That phrase covers all of the above. The trick is knowing which of these streams you can actually turn off.

What You Can Stop, What You Can't

Step 1: Find Out What Your Specific Car Collects

Before you try to turn anything off, you need to know what you're dealing with. The data a 2018 Honda Civic collects is not what a 2024 Tesla Model Y collects.

Privacy4Cars Vehicle Privacy Report

Privacy4Cars is the closest thing to a public database of vehicle data practices. Founder Andrea Amico built the site after his own research revealed that cars retained sensitive owner data long after resale. The site has a free Vehicle Privacy Report tool where you enter your VIN and get a list of the data categories your specific car model is configured to collect.

How to use it:

1. Find your VIN (driver's side dashboard, insurance card, or registration)
2. Go to vehicleprivacyreport.us
3. Enter the VIN
4. Read the report

Why this matters: The Mozilla review tested car brands generically. Privacy4Cars' tool is per-VIN, so you get the actual data practices of your year, make, model, and trim. If you don't have the VIN handy, you can also read the brand's general privacy practices on Mozilla's Privacy Not Included site.

Step 2: Disable the Connected Services You Don't Need

Every major automaker bundles a "connected services" program with new vehicles. They pitch it as safety, convenience, and remote start. The actual business model is your data.

Most programs can be partially or fully disabled. The catch: the dealership won't tell you this, and the opt-out is buried.

OnStar (GM: Chevrolet, GMC, Cadillac, Buick)

OnStar has been around since 1996. It started as an SOS button. It is now a data collection platform that monetizes your driving behavior.

GM killed the Smart Driver program in April 2024 after The New York Times exposed the data sales to LexisNexis and Verisk ^[1]. But OnStar itself still collects, and the data-sharing settings are still on by default in newer vehicles.

How to disable data sharing:

1. Go to gm.com/consumer-privacy
2. Click "Submit a privacy request"
3. Choose "Do Not Sell or Share My Personal Information"
4. Submit with your VIN and contact info
5. Also disable Smart Driver in the vehicle's infotainment system: Settings > OnStar > Smart Driver > Off

To cancel OnStar entirely: Call 1-888-4-ONSTAR (1-888-466-7827) and ask to cancel. You can also push the blue OnStar button in the car and ask the advisor. Cancellation is free. The SOS feature will stop working.

FordPass and Lincoln Way (Ford, Lincoln)

Ford's connected services let you remote-start, lock, and locate the vehicle. They also log your trips, speed, and aggressive cornering events for "Driver Score" programs.

How to disable data sharing:

1. Open the FordPass app
2. Go to Account > Privacy & Data
3. Toggle off "Driver Data Sharing," "Marketing Communications," and "Analytics"
4. In the vehicle: Settings > Connectivity > Connected Vehicle Features > Disable
5. For a full data rights request (delete what they have), file at Ford's privacy portal

HondaLink (Honda, Acura)

Honda's "Driver Feedback" program is the one that buries the data-sharing inside the infotainment settings. The actual opt-out is two menus past the safety-feature toggle.

How to disable:

1. In the vehicle: Settings > System > Data Sharing > Driver Feedback > Off
2. HondaLink app: Settings > Privacy > Data Sharing > Off
3. For a CCPA/CPRA request: honda.com/privacy/your-privacy-choices

Toyota Connected and Lexus Enform (Toyota, Lexus)

Toyota's "Insure Connect" program is the most obviously named. It pitches the data-sharing as a usage-based insurance discount. The actual data flow is the same as everyone else's: driving behavior goes to a data broker, which sells it to insurers.

How to disable:

1. Toyota app: Account > Connected Services > Manage > Disable "Driving Insights" and "Insure Connect"
2. In the vehicle: Menu > Setup > Data Privacy > Off
3. Privacy request: toyota.com/support/privacy-notice and look for the consumer privacy request link in the section about your state privacy rights

Tesla

Tesla is its own category. The cabin camera is always on during Autopilot. Software update 2026.8.6 added facial age estimation. Internal documents reviewed by researchers show cabin camera data feeds into a behavioral profiling system.

How to disable what you can:

1. In the vehicle: Controls > Safety > Data Sharing > toggle off everything
2. Tesla app: Account > Settings > Data Sharing > Off
3. For data deletion: tesla.com/support/contact and ask for a "privacy rights request." Tesla's data team will email a verification form

The hard truth: Tesla's data minimization is worse than other automakers. The cabin camera hardware cannot be physically disabled without voiding warranty in some configurations. If privacy is the priority, a Tesla is the wrong car.

Hyundai Blue Link, Kia UVO, Genesis Connected

Hyundai's Blue Link and Kia's UVO collect location, driving behavior, and remote commands. Kia's "Driving Score" program is the one to watch.

How to disable:

1. Blue Link / UVO app: Settings > Privacy > Data Sharing > Off
2. Disable Driving Score in the app
3. Privacy request: Hyundai data rights form

Subaru Starlink

Subaru's Starlink is a connected services bundle. It includes remote services, automatic collision notification, and stolen vehicle recovery. The data-sharing default is on.

How to disable:

1. In the vehicle: Settings > Starlink > Data Sharing > Off
2. MySubaru app: Account > Privacy > Data Sharing > Off
3. Privacy request: subaru.com/support/consumer-privacy

Volkswagen Car-Net

VW bundles Car-Net with most new vehicles. The program collects driving data, location, and remote-command logs. VW settled a class action in 2022 over the data collection practices.

How to disable:

1. Car-Net app: Settings > Privacy > Data Sharing > Off
2. Privacy request: privacy.vwgoa.com

Other brands (full privacy request list)

The EFF maintains a list of privacy request pages for every major brand: BMW, Mercedes-Benz, Nissan, Rivian, Stellantis (Chrysler, Dodge, Fiat, Jeep), Volvo, Jaguar, Land Rover, Mitsubishi, and Mazda. EFF published the list in March 2024. Some brand URLs have moved since then, so start with EFF's list and follow the brand-specific link from there.

What to request: EFF recommends filing three separate requests per brand: a "right to know" (copy of data they have), a "right to delete" (purge the data), and a "do not sell or share" (opt out of any onward sale). Some states require a response within 45 days. You typically get a CSV file with your driving events, sometimes a PDF, occasionally a folder with an HTML page.

Step 3: Check Whether Your Data Already Got Sold

Disconnecting the live data feed doesn't undo what's already been collected and resold. Two data brokers sit in the middle of the car-to-insurance pipeline: LexisNexis Risk Solutions and Verisk Analytics. GM was the most prominent company caught selling to them, but Honda, Hyundai, Ford, and others have used the same brokers ^[2].

The brokers hold a "consumer file" on you that includes a "driver score" computed from the data they bought. Insurers can pull this file. The file is invisible to you unless you ask for it.

LexisNexis consumer disclosure

1. Go to consumer.risk.lexisnexis.com/consumer
2. Click "Request a consumer disclosure report"
3. Verify your identity (the questions are about your credit history, which is easy if you have a mortgage and harder if you do not)
4. Wait 15 to 30 days for the report
5. Look for "C.L.U.E. Auto" entries and driving-event logs

If the report shows a driving history you didn't consent to, that's the smoking gun. LexisNexis has a dispute process that can remove incorrect or unauthorized entries.

Verisk consumer disclosure

1. Go to fcra.verisk.com
2. Click "Request your report"
3. Verify your identity
4. Wait for the file

Verisk's "Driver History Report" is the one that includes odometer readings, speed events, hard-braking counts, and time-of-day patterns pulled directly from connected car programs.

What if your state has a comprehensive privacy law?

Twenty states have consumer privacy laws in effect as of mid-2026. If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Iowa, Indiana, Tennessee, New Hampshire, Kentucky, Maryland, Minnesota, New Jersey, Rhode Island, Delaware, Florida, Montana, or Hawaii, you have a statutory right to know, delete, and opt out of sale ^[3]. Outside those states, you can still file the requests. Companies may or may not respond, but the request is on record.

Step 4: Oregon Residents: The Universal Opt-Out Signal

Oregon's Consumer Privacy Act took effect in July 2024. As of January 1, 2026, Oregon residents get a tool that other states don't have: a Universal Opt-Out Signal that applies to covered businesses across the internet, not just one site at a time ^[4].

How to set it up:

1. Open your browser settings (Firefox and Chrome both support this natively; Brave and Edge too)
2. Enable "Send a 'Global Privacy Control' signal" (Firefox: Settings > Privacy > Global Privacy Control; Chrome: Settings > Privacy and Security > Send a 'Do Not Track' request. Note that Chrome's DNT is different from GPC)
3. For the actual Oregon OCPA signal: install the Global Privacy Control browser extension if your browser doesn't support it natively
4. Oregon Attorney General Dan Rayfield confirmed January 28, 2026 that covered businesses, including car companies that advertise to Oregon residents, must honor the signal

The signal is a single browser setting. Businesses that see it must treat it as a valid opt-out of data sales and targeted advertising for any Oregon resident using that browser.

What it doesn't cover: The Universal Opt-Out applies to businesses that collect data through websites and apps. It does not directly reach the cellular modem in your car that phones home to the manufacturer's servers. You still need to file brand-specific requests (Step 2) for the car's own data collection. But for any car company that advertises to you online, the signal stops the ad targeting and the data sales that come with it.

What You Genuinely Cannot Stop

This is the part that stings.

Federal mandates coming online

The 2021 Infrastructure Investment and Jobs Act requires all new cars sold after September 2027 to include Driver Alcohol Detection System for Safety (DADSS) technology. NHTSA is finalizing the rules. The system includes infrared cameras that track your eyes and either breath sensors in the steering column or touch-based sensors in the start button. The mandate is the law. You will not be able to opt out of the safety feature, but the data retention and sharing rules for DADSS are still being negotiated. That is where the fight is now.

Built-in cellular modems

Even after you cancel OnStar, Blue Link, or any other connected service, the modem stays powered. It phones home for over-the-air software updates, recall campaigns, and emergency services. Tesla modems have been documented maintaining a heartbeat connection to Tesla servers for years after service cancellation in some cases.

Event data recorders (EDRs)

Every car sold in the US since 2014 has an EDR. It captures the seconds before a crash: speed, brake position, throttle, steering angle, seatbelt status. After a crash, this data is downloadable by law enforcement with a warrant, by your insurance company with your consent (or theirs), and by the manufacturer when the car is totaled. You cannot disable the EDR.

The OBD-II port insurance dongle

If you signed up for a usage-based insurance program (Progressive Snapshot, Allstate Drivewise, State Farm Drive Safe & Save, Liberty Mutual RightTrack, GEICO DriveEasy), you likely have a small device plugged into the OBD-II port under your dashboard. That dongle transmits your driving data to the insurer directly, bypassing the car manufacturer's opt-out entirely.

You can unplug it. But unplugging it usually voids the discount. Read the terms.

Step 5: When You Sell or Trade the Car

This is where most people fail. Cars retain data about you, your phone, your contacts, your garage door code, your home WiFi password, and your driving history. When the car leaves your possession, all of that leaves with it.

Privacy4Cars has a free Data Delete tool with model-specific instructions for clearing paired phones, navigation history, HomeLink codes, and connected-service accounts. The FTC published a vehicle privacy guide with a similar checklist.

Steps before handoff:

1. Delete all paired Bluetooth devices
2. Sign out of all connected-service accounts (don't just delete the app)
3. Factory reset the infotainment system
4. Delete navigation history and saved addresses
5. Unlink any HomeLink or garage door codes
6. Remove the car from your phone's digital car key (iOS CarKey, Android Digital Car Key)
7. File a "right to delete" with the manufacturer (use the brand list in Step 2)
8. Pull the OBD-II insurance dongle if you have one

Skip step 7 and the next owner inherits your driving profile in the manufacturer's data warehouse.

Common Questions

If I opt out, will my car still work?

Yes, with caveats. The engine, transmission, climate control, and most driving features are independent of the connected services. You lose remote start via app, automatic crash notification, stolen vehicle recovery, and over-the-air updates. The car still drives. Tesla is the partial exception: some software features are gated behind the connected account. If you opt out of Tesla's data sharing entirely, expect to lose some Autopilot functionality.

Does cancelling my connected service plan delete what they already collected?

No. Cancelling OnStar, Blue Link, or any other service stops future collection. The data already collected and sold is gone. To get that purged, file a "right to delete" privacy request through the brand's consumer privacy portal.

Can I check what my car has already shared with LexisNexis or Verisk?

Yes. File a free consumer disclosure with both. The LexisNexis process takes 15 to 30 days. Verisk is similar. The reports are yours by federal law (Fair Credit Reporting Act).

What about the car I leased and returned?

Same risk. The leasing company (which is usually a finance arm of the automaker: Toyota Financial, Honda Financial Services, GM Financial) has access to your driving data from the connected services. The data stays with the lease return. Do the cleanup steps in Step 5 before turning the car in.

What about my kid's car?

Connected services default to data sharing "on" for any driver. If your teenager drives a connected car, the same driving-profile pipeline applies. Teenage drivers are now the most aggressively scored demographic in usage-based insurance. The opt-out steps work the same way.

What if I'm an abuse survivor leaving a car behind?

Stalkers can use connected car features to track location. The vehicle's paired phone, the app account, and the connected service data are all attack surfaces. Privacy4Cars has resources specifically for survivors on how to wipe a car when leaving an abusive situation, including how to disable remote start, location sharing, and phone syncing that an ex could use to track you.

Checklist: Complete Car Data Opt-Out

The Industry Isn't Going to Fix This

GM's $12.75 million California penalty was the largest CCPA fine in history. It represented 0.007% of GM's 2025 annual revenue. The fine is a rounding error, not a deterrent. Ford's $375,703 California fine for making consumers hand over excessive data just to opt out is also negligible at Ford's scale.

Federal legislation has been stuck in Congress for years. The 2027 DADSS mandate adds a new mandatory surveillance layer to every new car without addressing the data-sharing practices that already exist. The FTC has only settled a handful of cases. State AGs are doing what they can, but there are 50 of them and dozens of automakers.

The opt-out steps above work. They are tedious, sometimes require a phone call, sometimes require waiting 45 days, and sometimes are quietly ignored. But they are the only tools available right now.

Your car is the most expensive privacy device you own. Treat it like one.

References

1. California Office of the Attorney General, "Attorney General Bonta Announces Largest CCPA Penalty in History Against GM for Selling Drivers' Data," May 8, 2026, oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-penalty-history-against-gm
2. Kravitz, Derek, "Your Car May Be Spying On You. Here's How to Get It to Stop," Consumer Reports, March 4, 2025, consumerreports.org
3. International Association of Privacy Professionals, US State Privacy Law Tracker, current as of June 2026
4. Oregon Department of Justice, "Oregon DOJ Highlights New 'Universal Opt-Out' Tool on Data Privacy Day," January 28, 2026, doj.state.or.us
5. Electronic Frontier Foundation, "How to Figure Out What Your Car Knows About You (And Opt Out of Sharing When You Can)," March 2024, eff.org
6. Electronic Frontier Foundation, "Car Makers Shouldn't Be Selling Our Driving History," June 2024, eff.org
7. Mozilla Foundation, "Privacy Nightmare on Wheels: Every Car Brand Reviewed by Mozilla Flunks Privacy Test," September 6, 2023, mozillafoundation.org
8. Privacy4Cars, Data In Cars, privacy4cars.com/data-in-cars
9. Senator Ed Markey letter to automakers on vehicle data collection, December 2023, markey.senate.gov