Consent in Connected Cars: Driver Data, Passengers, and Second Owners
A modern car is a sensor platform with seats. It logs location continuously, scores braking and acceleration, records voice commands, and syncs the contacts of whoever pairs a phone. Unlike a phone, it changes drivers constantly: partners, teenage children, mechanics, renters, and eventually a second owner.
This guide works through the consent questions connected cars raise: setup choices by one driver, passengers who never see a screen, rental and shared fleets, and the handover problem when the car is sold with its data history still inside.
One setup screen, many drivers
Connected car data collection is usually accepted once, by whoever configures the car first, on a delivery day screen they are keen to get past. Everyone who drives afterward inherits that choice invisibly. Better designs show the current data state on the main settings screen, tie optional data uses to driver profiles where the car supports them, and make the off switch physical or one tap deep rather than buried in a legal menu. Insurance scoring and location sharing deserve separate choices, because both reach far beyond making the car work.
Passengers and paired phones
Passengers generate data without any relationship with the manufacturer: their voices in cabin recordings, their presence in location logs, and their contact details when a driver syncs a phone that holds them. The practical duties sit with design: minimise what is captured from non account holders, avoid building profiles from passenger data, and make phone sync selective so a driver can pair for calls without uploading an entire address book. Fleet and family cars should surface who is tracked and how to pause it.
Rentals, courtesy cars, and fleets
A rental car may hold the paired phones and destinations of dozens of previous renters if nobody wipes it. Rental firms should make data wipe part of the return checklist, automatic where the car supports it, and tell renters at pickup what the car collects and how to clear it at drop off. Employers running fleets have the mirror problem: tracking that is legitimate for logistics becomes surveillance when it keeps running on an employee's evening trip home, so private mode needs to be real and its use kept free of penalty.
Selling the car means handing over or deleting its memory
At sale, the car carries years of location history, home addresses, garage codes, and paired devices. Manufacturers should provide a single, obvious erase everything flow that clears the car and the linked cloud account together, and dealers should verify it the way they verify a spare key. Buyers of used connected cars should run that erase before pairing anything of their own. Regulators increasingly treat a car data history as personal data of the previous owner, which makes a lazy handover a liability for everyone in the chain.
Related reading
These earlier guides cover connected questions in more depth: Consent and Voice Assistants: Choices for Always Listening Devices, How Long to Keep Consent Records: A Practical Retention Schedule, and Consent in Mobile Apps: Getting SDK Signals Right.
Frequently asked questions
Can I turn off connected car data collection entirely?
Usually partly. Safety and legally required systems may keep working, but optional uses like marketing, scoring, and non essential location history should have off switches. Check the privacy settings in the car and the companion app, because some controls live in only one of them.
Does the car track me if I never created an account?
It can. Many cars collect and transmit operational data under the delivery paperwork rather than an app account. Ask the dealer what is active by default and what the process is to limit it before you buy.
What should a rental company delete between renters?
Paired phones, call and message sync, saved destinations and home addresses, voice history, and app logins. The wipe should be verified on the return checklist, not left to the next renter to discover.
Who owns the data when a couple shares one car?
Both drivers have interests in it. Profile based settings help where they exist. Where they do not, either driver should be able to see the data state and pause optional collection, and neither should be able to secretly track the other.