Modern vehicles generate continuous location and behavioral data, and the discovery that driving data reached insurers through telematics programs turned this into an enforcement issue. This hub covers it.
Cross-Border Transfers
October 5, 2026
The Bureau of Industry and Security's connected vehicle rule is a supply chain control, not a privacy statute. It bars importing or selling passenger vehicles with connectivity or automated driving software tied to China or Russia from model year 2027, and importing their connectivity hardware from model year 2030, enforced through annual Declarations of Conformity.
Read more →
Data Brokers
October 5, 2026
The FTC alleged that General Motors enrolled drivers in OnStar Smart Driver through a bundled consent screen and then sold their driving events to Verisk and LexisNexis, which built consumer reports that insurers used. The order, proposed in January 2025 and issued as final in January 2026, runs 20 years and contains no payment.
Read more →
Consent Management
October 5, 2026
An event data recorder keeps a few seconds of vehicle data around a crash. Federal law makes that data the property of the vehicle's owner or lessee and lists five situations in which someone else may access it, while NHTSA's Part 563 sets what an installed recorder must capture. Eight state statutes read for this post add their own consent rules, insurer limits and penalties.
Read more →