Although the auto industry has faced scrutiny from state and federal regulators in recent years, expect that scrutiny to intensify in 2026, given changes in the law and enforcement actions that took place in 2025. The industry is entering a new era in which vehicle‑generated data is no longer viewed as a byproduct of innovation, but as a category of highly sensitive consumer information warranting strict regulatory oversight. In 2026, automakers should anticipate more aggressive enforcement, more state‑specific rules, and more pressure to demonstrate responsible data stewardship.

As automakers move deeper into software‑powered vehicles, telematics‑enabled services, subscription‑based features, and data‑driven partnerships with insurers and analytics providers, regulators are increasingly scrutinizing how vehicle‑generated data is collected, used, shared, and secured. This series will first focus on activity at the federal level in this space. A future post will delve deeper into regulatory enforcement and legislative activity at the state level.

FTC Turns Its Attention to Automakers

Federal regulators and others have scrutinized the privacy practices of connected cars for several years, but the Federal Trade Commission (FTC) in May 2024 announced it would focus more closely on the privacy risks associated with connected vehicles and would press enforcement actions relating to the collection of location data and sensitive information. The FTC warned that its longstanding concerns about consumer tracking, opaque data practices, and “unexpected uses” of personal information would be applied to the automobile industry. This trend expanded earlier concerns, ranging from national security and supply chain risks to the potential impact on individual safety and privacy. 

The FTC cautioned automobile manufacturers and other businesses that it would take action to protect consumers from the unlawful use, collection, and disclosure of their personal data. The FTC highlighted the following lessons from its recent enforcement actions:

• Under the FTC Act, as interpreted by the FTC, geolocation data is considered to be sensitive and subject to enhanced protections. The FTC noted that cars are very similar to mobile phones in that they can track consumers’ visits to sensitive locations.
• The surreptitious disclosure of sensitive information (such as geolocation data) can be considered to be an unfair practice. The FTC cited enforcement actions where it took action against companies using sensitive data for advertising purposes.
• It can be unlawful to use sensitive data for automated decisions. The FTC further cautioned against feeding consumer data into algorithms if such actions result in harmful (and discriminatory) decisions.

In its May 2024 statement, the FTC warned companies that they do “not have the free license to monetize people’s information beyond purposes needed to provide their requested product or service, and firms shouldn’t let business model incentives outweigh the need for meaningful privacy safeguards.” Furthermore, the FTC stressed the importance of data minimization and warned companies that they should not collect, use, or share sensitive information when such data was not necessary for providing their products and services. This announcement laid the groundwork for the enforcement activity that intensified significantly in 2025.

FTC Accelerates Enforcement for Geolocation Data

Following its warning that it would increasingly scrutinize the use of geolocation and other sensitive data, the FTC in January 2025 announced it had reached an agreement with General Motors and OnStar to resolve issues about how those companies collected and shared vehicle‑generated data, including location and telematics information. The settlement, finalized in January 2026, includes a five-year ban on disclosing geolocation and driver behavior data to consumer reporting agencies, and also requires the manufacturer to take a number of steps to obtain consent for and protect consumer data, including providing customers the ability to disable geolocation data collection from their vehicles and opt out of such collection. 

The FTC took a broad view of “covered driver data” to include location and certain information originating from a vehicle or a mobile device or derived data (including algorithmically-generated data). These actions signal that federal regulators are comfortable applying traditional deception and unfairness authorities under Section 5(a) of the FTC Act to the connected‑vehicle ecosystems. Moreover, beyond the application of the FTC Act to the collection of vehicle-generated geolocation and other sensitive data, courts continue to wrestle with how precedent interpreting the Fourth Amendment of the U.S. Constitution, which protects against unreasonable searches and seizures, should be applied to government demands for access to this data. 

Watch the Road for State-Related Updates

As mentioned above, the FTC is not the only regulator focused on these issues. Our next article will look into state-level enforcement by California and Texas, along with recent legislative changes that impact the auto industry.