Security Widely confirmed 5 publishers 2 min read Published Oct 1, 2026, 4:19 AM PDT

First-start consent screens open new cars' driving data to insurers and brokers

Consumer Reports and Northeastern studied 15 automakers and found drivers can unknowingly agree to driving-data collection at a new car's first start-up. The exposure is consent given on a touchscreen, and tracking where the data goes falls to whoever owns the car or the fleet.

The Watch · Security desk

Send a correction

Illustration accompanying First-start consent screens open new cars' driving data to insurers and brokers — Generated illustration

What happened

Consumer Reports read thousands of pages of privacy policies and questioned BMW, Ford, GM, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Stellantis, Subaru, Tesla, Toyota and Volkswagen.
The same consent forms can also pop up in a connected mobile app, and many owners accept the terms without reading them.
Insurers and lenders receive the data as partners in telematics data exchanges that compile driving data on millions of drivers.
Local and state government agencies working on planning, traffic and safety projects are also among the recipients.

Why it matters

Who's exposed exposure Drivers who finance a car or buy insurance can be assessed on trip data they did not knowingly hand over.
Who has to decide decision Fleet operators have to treat vehicle provisioning as a consent event and decide who accepts the first-start forms, and whether anyone should.
What it limits constraint The controls are the consent screens and the purchase or lease terms, so privacy and procurement staff own this exposure and the security team supports them.

Next story · Leadership · 50m ago

GM faces a federal suit over how Spring Hill handled a group leader's internal complaints

Confirmed2 publishers

No exploit is involved. The data leaves under terms someone accepted, and Consumer Reports wrote that "you may agree without knowing you've done so" ^[5]. The agreement arrives as a series of consent forms, privacy policies among them, on the infotainment display that also controls heat and AC, navigation and music ^[6].

CR's account assumes the person at that screen is the buyer of a new car ^[6]. In a fleet, the person at the screen is whoever provisions the vehicle. The terms they accept then cover data from the drivers who take it out later ^[13].

On insurance, CR's evidence is about who buys the data. CR reviewed corporate, regulatory and legal filings from insurtech brokers, the companies that help insurers set their rates ^[3]. Thousands of data brokers on the receiving end build personalized risk scores ^[9]. The schneier.com post that carried the excerpt went further: "Basically, your car's manufacturer has you under constant surveillance, and they use that data against you" ^[12]. The research supports the collection half of that sentence. The excerpt does not say which of the 15 automakers send data to which buyers, or show a premium that changed because of one driver's trips ^[2].

The buyers extend past insurance. Companies selling infotainment and WiFi hotspot products receive the data too ^[11]. Several car privacy experts CR spoke with have described the profit potential of individual driving data as the "new oil" at industry conferences and in market reports ^[4].

What to watch

Per-automaker results showing which of the 15 brands send data to telematics exchanges or insurtech brokers.
An insurer or lender disclosure tying a rate or credit decision to data bought from a telematics data exchange.
Regulatory or legal action over consent captured on first-start infotainment screens.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption80
Hype gap+20
Incentives45
Confidence60

Perspective Coverage

5 publishers

Builder: Builder 24%
Operator: Operator 56%
Investor: Investor 20%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy on their drivers.
Reported Supported Source: Consumer Reports / Northeastern University research, excerpted on schneier.comView cited source
[2]
Consumer Reports dug through thousands of pages of automakers' privacy policies and asked questions of 15 automakers: BMW, Ford, General Motors, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Stellantis, Subaru, Tesla, Toyota and Volkswagen.
Reported Supported Source: Consumer ReportsView cited source
[3]
Consumer Reports reviewed corporate, regulatory and legal filings from data brokers in the 'insurtech' industry, the technology companies and data brokers that help insurance companies set their rates.
Reported Supported Source: Consumer ReportsView cited source
[4]
Several car privacy experts Consumer Reports spoke to have, at industry conferences and in market reports, described the profit potential of individual driving data as the 'new oil.'
Reported Supported Source: Consumer ReportsView cited source
[5]
"We found that while some automakers may obtain your 'permission' to collect your driving data, you may agree without knowing you've done so."
Reported Supported Source: Consumer Reports, as excerpted on schneier.comView cited source
[6]
After buying a new car, when the owner first turns on the infotainment system, the onboard display that can control heat and AC, GPS navigation and music, they are usually shown a series of consent forms, including ones about privacy policies.
Reported Supported Source: Consumer ReportsView cited source
[7]
The consent forms can also pop up on a connected mobile app, and many people simply accept the terms without reading them.
Reported Supported Source: Consumer ReportsView cited source
[8]
Companies receiving drivers' data include car insurers and lenders that are partners in 'telematics data exchanges,' which compile driving data on millions of drivers.
Reported Supported Source: Consumer ReportsView cited source
[9]
Recipients of drivers' data include thousands of data brokers that create personalized risk scores.
Reported Supported Source: Consumer ReportsView cited source
[10]
Recipients of drivers' data include local and state government agencies working on planning, traffic and safety initiatives.
Reported Supported Source: Consumer ReportsView cited source
[11]
Recipients of drivers' data include companies selling infotainment and WiFi hotspot products.
Reported Supported Source: Consumer ReportsView cited source
[12]
"Basically, your car's manufacturer has you under constant surveillance, and they use that data against you."
Reported Contested Source: Commentary in the schneier.com post that excerpted the Consumer Reports researchView cited source
[13]
For a fleet-owned vehicle, the consent forms shown at first infotainment start-up are accepted by whoever provisions the vehicle, and those terms then cover data from drivers who use it later.
Derived Insufficient

Sources

5 independent publishers whose own reporting we read for this story.

helpnetsecurity.com
1 article · October 1, 2026
Some car apps are slipping owners’ data to big tech companies
malwarebytes.com
1 article · September 30, 2026
Your car’s app could be telling Big Tech who you are and where you go
schneier.com
1 article · October 1, 2026
Connected Cars Are a Surveillance Platform
techcrunch.com
1 article · September 29, 2026
Your car and its mobile app are probably handing over all kinds of data to tech companies
therecord.media
1 article · September 30, 2026
Automakers routinely share personally identifiable connected-car data with third parties, report says

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder24%

Help Net Security's account is the one an engineer can use. Every tested car rejected the researchers' injected certificates, so the team logged which domains were contacted and could not see payloads. Most cellular traffic was out of reach until 11 EVs went into a Faraday tent, and the Tesla Model 3 then contacted 27 more tracking-related domains. The researchers said the companion app 'at least doubles cumulative ATA exposure' for most vehicles. VINs leaked from apps, in their words, 'cannot be changed,' unlike a phone's ad ID.

Operator56%

For anyone who owns or manages these vehicles, the practical problem is consent. Malwarebytes quotes Tesla warning that refusing its terms may cause 'reduced functionality, serious damage, or inoperability.' Help Net Security found that the privacy policies said data may go to third parties but did not name them. Our headline's fleet angle goes past the sources, none of which looks at vehicles set up by one party and driven by others.

Investor20%

The Record supplies the money context. California regulators fined GM more than $12 million in May and barred it for five years from sharing driver data with credit reporting agencies and data brokers. Malwarebytes adds the Texas attorney general's lawsuit against GM. The new study names four GM apps sending VINs to Adobe, Acxiom, Google, Meta and others, though none of our sources ties those flows to the terms of the California order.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence60: 0100
Solid traffic data, thin consent chain
Four outlets report the same peer-reviewed traffic capture, and they agree on 19 of 21 vehicles and 7 of 30 apps. The consent-screen and insurer-buyer details depend on a single excerpt of Consumer Reports text on Schneier's blog. The researchers also say their counts are a lower bound, because cellular and server-side traffic were mostly hidden from them.
Adoption80: 0100
Sharing is the norm across the test fleet
Here adoption means how widespread the data sharing is. Nineteen of the 21 test vehicles reached a third party over Wi-Fi, and The Record counts 28 of 30 apps sending data to ad or analytics firms. Honda is the only company reported to have changed its practice after seeing the results.
Hype gap+20: −100 understated0 aligned+100 overstated
Rhetoric outpaces what was measured
Schneier says manufacturers keep drivers 'under constant surveillance' and 'use that data against you.' The traffic study logged contacts with advertising, tracking and analytics domains, and it did not follow any data to insurers or lenders. Automakers say recipients are contractually restricted. The authors' lower-bound caveat cuts the other way, so the overstatement is modest.
Incentives45: 0100
Advocates and automakers both have interests here
Consumer Reports is an advocacy nonprofit and co-ran the research. Malwarebytes ends its piece by promoting its own VPN. Automakers told Consumer Reports the sharing is opt-in and that some recipients may not 'independently' use or sell the data, a defense from the companies whose practices are under scrutiny. The experts' 'new oil' description shows there is a market for driving data.
Confidence60: 0100
Firm on counts, softer on the chain
I'd trust the vehicle and app counts, which line up across four independent write-ups of one paper. The rest is less certain. Brand totals range from 17 to 19 between outlets, the consent and recipient details come from one excerpt, and the fleet reading in our headline has no source behind it.

Topics and entities

Topics

Data Brokers
Advertising and analytics tracking
Connected-car privacy