What Are Cars Collecting? A Study of Privacy Policies in the Automotive Industry

Modern vehicles collect and transmit extensive personal data through embedded sensors and connected services, yet privacy implications remain poorly understood. We present a policy-level analysis of 17 major vehicle manufacturers’ U.S. privacy policies to investigate what data is collected, how it is shared, and what rights users—both primary and non-primary—are afforded. Our findings reveal that sensitive information such as geolocation, biometric identifiers, and in-cabin audio may be collected, often with vague or inconsistent disclosures. Most manufacturers share user data with third parties, and opt-out mechanisms are limited, complex, or restricted by region. Notably, policies vary in how they handle data from passengers and non-primary drivers, frequently shifting the burden of disclosure to the vehicle owner. This work highlights key transparency gaps in the automotive privacy ecosystem and motivates future studies, including user perception research and technical audits to determine whether actual data practices align with policy claims.