Your car is ratting you out — and your business might be paying for it.
Not metaphorically. Literally. The vehicle sitting in your parking lot right now is logging where you've been, how hard you braked on I-95, how long you idled outside a client's warehouse, and what time you left the house this morning. And in most cases, that data is being packaged and sold — without your knowledge, without a clear opt-out, and without any benefit flowing back to you.
This isn't a future problem. It's happening now, at scale, across nearly every major brand on the road. If you run a fleet, send sales reps to client sites, or just drive your own truck to meetings, you have exposure you probably haven't priced in.
What Your Car Is Actually Collecting
Modern vehicles are essentially smartphones on wheels — except they collect data your phone can't. We're talking about sensors, cellular modems, and onboard computers that run 24/7 and sync to manufacturer servers every time you drive.
Here's what's being recorded on most connected vehicles built after 2015:
- Precise GPS location history — every stop, every route, timestamped
- Braking and acceleration patterns — flagged as "aggressive" or "safe" by algorithms you never agreed to
- Idle time and engine-on duration — useful for fleet management, but also for insurers building risk profiles
- Seatbelt usage and speed relative to posted limits
- In-cabin voice data on vehicles with always-on microphones
- Charging and fuel patterns on EVs and hybrids
A 2023 investigation by The New York Times confirmed that General Motors had been quietly enrolling drivers in its OnStar Smart Driver program and sharing detailed behavioral scores with data brokers LexisNexis and Verisk — companies that sell risk analytics directly to auto insurers. Drivers saw their premiums spike. None of them had filed a claim. Some didn't even know OnStar was active on their vehicle.
Major automakers have been caught selling precise driver location data to insurers who then raised premiums — without the driver ever filing a claim.
That's not a privacy complaint. That's a business expense nobody budgeted for.
Why This Is an SMB Problem, Not Just a Personal One
Here's where most business owners miss it: they think of vehicle data as a personal inconvenience. It's not. It's an operational liability.
Consider what's actually at stake when you run vehicles for business:
- Fleet insurance costs — if your drivers' behavioral data is being fed to insurers without your consent, your premiums can move based on data you never reviewed or disputed
- Client confidentiality — location logs showing repeated visits to a specific address can reveal client relationships, supplier locations, or competitive intelligence to anyone who buys that data
- Employee privacy obligations — in California, Colorado, Virginia, and a growing list of states, businesses have legal duties around employee data, and that extends to data collected by third-party systems your employees use for work
- Negotiating leverage you don't know you're losing — a data broker who knows your rep visits the same competitor's zip code every Tuesday has information you'd rather keep internal
If you have even two or three vehicles on the road for business purposes, this is a line item and a legal exposure you need to treat seriously.
What to Actually Do About It — Right Now
The good news: this doesn't require a lawyer or a six-figure tech budget. It requires about 90 minutes and a willingness to dig into some settings most people never open.
Start here:
- Audit your connected services. Log into your automaker's owner portal (GM's myGMC, Ford's FordPass, Toyota's Connected Services, etc.) and review every program your vehicle is enrolled in. Look specifically for anything labeled "data sharing," "driver behavior," or "smart driving."
- Opt out where possible. Most manufacturers are now required to offer an opt-out under state privacy laws. It's usually buried, but it's there. GM suspended its data-sharing program with brokers after the NYT story — but that doesn't mean others stopped, and it doesn't mean GM won't restart it.
- Review your fleet insurance policy. Ask your insurer directly: are you receiving behavioral data from any third-party data aggregator tied to my vehicles? You have the right to ask. The answer may surprise you.
- Update your employee agreements. If your team drives company vehicles or uses personal vehicles for work, your policy should address what data is collected, who owns it, and what happens to it. Most SMB employee handbooks are silent on this entirely.
- Consider a telematics policy. If you want location and behavior data for legitimate fleet management — route efficiency, liability protection — use a system you control, with data that stays in your stack, not a manufacturer's monetization pipeline.
None of this is complicated. It's just the kind of operational detail that falls through the cracks when you're running a business and nobody flags it as urgent — until a premium jumps or a client asks why your rep's location showed up somewhere it shouldn't have.
The Bigger Picture for Operators
We talk a lot at Maqia about automation and AI tools that give small operators a real edge. But automation only works when your data hygiene is solid. If the data coming out of your vehicles, your apps, and your workflows is being quietly harvested and sold, you're not just losing privacy — you're losing control of your own operation.
Knowing what your business systems collect, who they share it with, and how to lock that down is as fundamental as knowing your margins or your payroll. It's not optional anymore.
We put together a plain-English guide that walks you through exactly how to audit your vehicles, what to look for in your fleet agreements, and what questions to ask your insurer — no technical background required. Head to maqia.co and grab the free guide. If you run anything on wheels for your business, it's worth 20 minutes of your time before your next renewal comes around.