Security Widely confirmed 5 publishers2 min readPublished Oct 1, 2026, 4:19 AM PDT

First-start consent screens open new cars' driving data to insurers and brokers

Consumer Reports and Northeastern studied 15 automakers and found drivers can unknowingly agree to driving-data collection at a new car's first start-up. The exposure is consent given on a touchscreen, and tracking where the data goes falls to whoever owns the car or the fleet.

The Watch · Security desk

How we use AI Send a correction

Illustration accompanying First-start consent screens open new cars' driving data to insurers and brokers — Generated illustration

What happened

Consumer Reports read thousands of pages of privacy policies and questioned BMW, Ford, GM, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Stellantis, Subaru, Tesla, Toyota and Volkswagen.
The same consent forms can also pop up in a connected mobile app, and many owners accept the terms without reading them.
Insurers and lenders receive the data as partners in telematics data exchanges that compile driving data on millions of drivers.
Local and state government agencies working on planning, traffic and safety projects are also among the recipients.

Why it matters

exposure Drivers who finance a car or buy insurance can be assessed on trip data they did not knowingly hand over.
decision Fleet operators have to treat vehicle provisioning as a consent event and decide who accepts the first-start forms, and whether anyone should.
constraint The controls are the consent screens and the purchase or lease terms, so privacy and procurement staff own this exposure and the security team supports them.

No exploit is involved. The data leaves under terms someone accepted, and Consumer Reports wrote that "you may agree without knowing you've done so" ^[5]. The agreement arrives as a series of consent forms, privacy policies among them, on the infotainment display that also controls heat and AC, navigation and music ^[6].

CR's account assumes the person at that screen is the buyer of a new car ^[6]. In a fleet, the person at the screen is whoever provisions the vehicle. The terms they accept then cover data from the drivers who take it out later ^[13].

On insurance, CR's evidence is about who buys the data. CR reviewed corporate, regulatory and legal filings from insurtech brokers, the companies that help insurers set their rates ^[3]. Thousands of data brokers on the receiving end build personalized risk scores ^[9]. The schneier.com post that carried the excerpt went further: "Basically, your car's manufacturer has you under constant surveillance, and they use that data against you" ^[12]. The research supports the collection half of that sentence. The excerpt does not say which of the 15 automakers send data to which buyers, or show a premium that changed because of one driver's trips ^[2].

The buyers extend past insurance. Companies selling infotainment and WiFi hotspot products receive the data too ^[11]. Several car privacy experts CR spoke with have described the profit potential of individual driving data as the "new oil" at industry conferences and in market reports ^[4].

What to watch

Per-automaker results showing which of the 15 brands send data to telematics exchanges or insurtech brokers.
An insurer or lender disclosure tying a rate or credit decision to data bought from a telematics data exchange.
Regulatory or legal action over consent captured on first-start infotainment screens.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption80
Hype gap+20
Incentives45
Confidence60

Perspective Coverage

5 publishers

Builder: Builder 24%
Operator: Operator 56%
Investor: Investor 20%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy on their drivers.
ReportedSupportedSource: Consumer Reports / Northeastern University research, excerpted on schneier.com3 sources— create a free account to open them View cited source
[2]
Consumer Reports dug through thousands of pages of automakers' privacy policies and asked questions of 15 automakers: BMW, Ford, General Motors, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Stellantis, Subaru, Tesla, Toyota and Volkswagen.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[3]
Consumer Reports reviewed corporate, regulatory and legal filings from data brokers in the 'insurtech' industry, the technology companies and data brokers that help insurance companies set their rates.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[4]
Several car privacy experts Consumer Reports spoke to have, at industry conferences and in market reports, described the profit potential of individual driving data as the 'new oil.'
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[5]
"We found that while some automakers may obtain your 'permission' to collect your driving data, you may agree without knowing you've done so."
ReportedSupportedSource: Consumer Reports, as excerpted on schneier.com3 sources— create a free account to open them View cited source
[6]
After buying a new car, when the owner first turns on the infotainment system, the onboard display that can control heat and AC, GPS navigation and music, they are usually shown a series of consent forms, including ones about privacy policies.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[7]
The consent forms can also pop up on a connected mobile app, and many people simply accept the terms without reading them.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[8]
Companies receiving drivers' data include car insurers and lenders that are partners in 'telematics data exchanges,' which compile driving data on millions of drivers.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[9]
Recipients of drivers' data include thousands of data brokers that create personalized risk scores.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[10]
Recipients of drivers' data include local and state government agencies working on planning, traffic and safety initiatives.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[11]
Recipients of drivers' data include companies selling infotainment and WiFi hotspot products.
ReportedSupportedSource: Consumer Reports3 sources— create a free account to open them View cited source
[12]
"Basically, your car's manufacturer has you under constant surveillance, and they use that data against you."
ReportedContestedSource: Commentary in the schneier.com post that excerpted the Consumer Reports research4 sources— create a free account to open them View cited source
[13]
For a fleet-owned vehicle, the consent forms shown at first infotainment start-up are accepted by whoever provisions the vehicle, and those terms then cover data from drivers who use it later.
DerivedInsufficient1 source— create a free account to open them

Sources

5 independent publishers whose own reporting we read for this story.

helpnetsecurity.com
1 article · October 1, 2026
Some car apps are slipping owners’ data to big tech companies
malwarebytes.com
1 article · September 30, 2026
Your car’s app could be telling Big Tech who you are and where you go
schneier.com
1 article · October 1, 2026
Connected Cars Are a Surveillance Platform
techcrunch.com
1 article · September 29, 2026
Your car and its mobile app are probably handing over all kinds of data to tech companies
therecord.media
1 article · September 30, 2026
Automakers routinely share personally identifiable connected-car data with third parties, report says

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder24%

Help Net Security's account is the one an engineer can use. Every tested car rejected the researchers' injected certificates, so the team logged which domains were contacted and could not see payloads. Most cellular traffic was out of reach until 11 EVs went into a Faraday tent, and the Tesla Model 3 then contacted 27 more tracking-related domains. The researchers said the companion app 'at least doubles cumulative ATA exposure' for most vehicles. VINs leaked from apps, in their words, 'cannot be changed,' unlike a phone's ad ID.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence60: 0100
Solid traffic data, thin consent chain
Four outlets report the same peer-reviewed traffic capture, and they agree on 19 of 21 vehicles and 7 of 30 apps. The consent-screen and insurer-buyer details depend on a single excerpt of Consumer Reports text on Schneier's blog. The researchers also say their counts are a lower bound, because cellular and server-side traffic were mostly hidden from them.
Adoption80: 0100
Sharing is the norm across the test fleet
Here adoption means how widespread the data sharing is. Nineteen of the 21 test vehicles reached a third party over Wi-Fi, and The Record counts 28 of 30 apps sending data to ad or analytics firms. Honda is the only company reported to have changed its practice after seeing the results.
Hype gap+20: −100 understated0 aligned+100 overstated
Rhetoric outpaces what was measured
Schneier says manufacturers keep drivers 'under constant surveillance' and 'use that data against you.' The traffic study logged contacts with advertising, tracking and analytics domains, and it did not follow any data to insurers or lenders. Automakers say recipients are contractually restricted. The authors' lower-bound caveat cuts the other way, so the overstatement is modest.
Incentives45: 0100
Advocates and automakers both have interests here
Consumer Reports is an advocacy nonprofit and co-ran the research. Malwarebytes ends its piece by promoting its own VPN. Automakers told Consumer Reports the sharing is opt-in and that some recipients may not 'independently' use or sell the data, a defense from the companies whose practices are under scrutiny. The experts' 'new oil' description shows there is a market for driving data.
Confidence60: 0100
Firm on counts, softer on the chain
I'd trust the vehicle and app counts, which line up across four independent write-ups of one paper. The rest is less certain. Brand totals range from 17 to 19 between outlets, the consent and recipient details come from one excerpt, and the fleet reading in our headline has no source behind it.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Data Brokers Follow
Advertising and analytics trackingFollow
Consent DesignFollow
Connected-car privacyFollow

Entities

General Motors Follow
Tesla Follow
California Privacy Protection AgencyFollow
Honda Follow
Consumer Reports Follow
Amplitude Follow
Northeastern University Follow