Your Car Is Watching. The FTC Just Proved It Wasn't Only Toyota.

What the FTC Just Did

On January 14, 2026 — five weeks before my CNN story ran — the FTC finalized its first-ever enforcement order on connected vehicle data against General Motors, GM Holdings, and OnStar. GM enrolled customers in "Smart Driver" by marketing it as a tool to improve driving habits. What customers weren't told: GM intended to sell that data — every hard brake, every late-night drive, every instance of speeding — to consumer reporting agencies, who compiled it into reports insurance companies used to deny coverage, cancel policies, or raise rates. The FTC banned GM from sharing that data with consumer reporting agencies for five years and ordered affirmative consent before any data collection. These aren't voluntary changes. They're court-ordered.

Why This Matters Beyond GM and Toyota

The FTC stated in its own guidance: car manufacturers — and all businesses — should take note that the FTC will take action against the illegal collection, use, and disclosure of personal data. GM and Toyota aren't outliers. They're the ones who got caught. The same infrastructure, the same incentive to monetize driving data, and the same buried fine print exist across virtually every major automaker in America.

What You Should Know About Your Own Car

The FTC found that GM's enrollment process was so confusing some consumers didn't know they'd been signed up. That's not a bug — it's how these programs are designed. If you drive a connected vehicle, ask:

• —Has your automaker enrolled you in a data-sharing program?
• —Is your driving behavior being transmitted to third parties?
• —Have your insurance rates changed in ways you can't explain?

The FTC says you have the right to know, opt out, and delete. Most people have never been told that.

The Pattern Is the Story

When my story broke, people told me I was an outlier. The FTC just made it official: I wasn't. The same week I discovered Progressive had my braking data, the federal government was finalizing an order against GM for doing the exact same thing to millions of drivers. This is a business model — not an accident.

What Toyota Says About Itself

Most of the conversation about vehicle data privacy focuses on what companies are doing behind the scenes. But some of the most important information is sitting in plain sight on Toyota's own website.

Toyota's published privacy notice at toyota.com confirms that vehicles equipped with Connected Services electronically transmit vehicle-originated data, specifically including driving behavior data and vehicle health data, back to Toyota. This is not speculation. This is Toyota's own language describing their own system.

The notice also separately discloses that during 2024, Toyota shared customer personal information with specific other parties where that information was used for those parties' own marketing purposes.

There is another detail worth paying attention to. Toyota deliberately separates the Connected Services Privacy Notice from their main Toyota Privacy Notice. The data your vehicle transmits is governed by a completely different document than the one most customers read. Unless you know to search for toyota.com/privacyvts specifically, you will not find it through normal navigation.

Toyota Financial Services, Toyota Insurance Management Solutions, and individual dealers each operate under their own separate privacy notices as well. Toyota's main privacy notice explicitly states it does not cover the data practices of those entities.

I am not making a legal argument here. I am pointing out what Toyota's own documents say. Drivers who want to understand what is happening with their vehicle data should start with the source. Pull your LexisNexis Driving Report under FCRA. Read Toyota's Connected Services privacy notice at toyota.com/privacyvts. Then decide for yourself what you think about the gap between what most customers know and what the disclosures actually say.