9 Things an Oregonian’s New Car Records Without Asking
Oregon widened its consumer privacy law last year to cover the data automakers pull from a car’s sensors, under House Bill 3875.
A newer car’s onboard systems often start logging the moment you turn the key, long before anyone reads a privacy policy.
These are the things an Oregonian’s high-tech car often records without asking.
Note: This is general information, not legal advice. Vehicle data-privacy rules vary by state and are subject to change, so confirm your rights under Oregon’s Consumer Privacy Act with the Oregon Department of Justice.
1. Your Location, Every Few Seconds
Location recording runs by default in many connected cars.
General Motors’ OnStar system pushed that further: It tracked location as often as every three seconds, according to the Federal Trade Commission.
That’s not a single ping.
It’s a running record of everywhere the vehicle goes, built up without a fresh prompt each trip.
The Federal Trade Commission voted in January 2025 to act against how GM and OnStar shared that location and driving-behavior data.
The order, not finalized until January 2026, bars the company from sharing that data with consumer reporting agencies and data brokers for five years.
GM can still share de-identified versions of the data with research and emergency-response partners, though the recording itself never needed anyone’s permission to start in the first place.
2. Hard Brakes and Late-Night Drives
A car’s onboard systems track more than location: Hard brakes, speeding, and late-night drives all get recorded too.
The same OnStar system logged hard-braking events, speeding, and late-night trips through a feature called Smart Driver.
Every one of those moments became a data point.
It wasn’t a warning.
General Motors (GM) shared those scores with consumer reporting agencies.
Some drivers saw their insurance rates rise before they even knew the data existed.
Smart Driver is gone now, but similar scoring still runs through other automakers’ connected apps.
3. Saved Passwords and Garage Codes
Nobody ever asks whether a car should record the passwords and codes a driver types into it.
Infotainment systems store whatever a driver types into onboard apps, including saved Wi-Fi passwords and garage door codes.
None of it clears automatically.
Privacy4Cars founder Andrea Amico has found that data stays on a car’s system until somebody manually wipes it.
Just over half of renters sync their phones to a rental car’s system.
Fewer than half of those remember to erase their profile before returning the keys, according to Hartford Steam Boiler data cited by NBC News.
4. Contacts, Copied to the Dashboard
A phone’s contacts get copied without asking into a car’s dashboard the moment the two pair up.
Once a phone pairs with the touchscreen, the system pulls in contacts, call logs, and text messages.
That copy stays behind even after the phone disconnects.
Deleting a number on the phone does nothing to the copy in the dashboard.
The two never sync.
A new owner, a rental customer, or a curious mechanic can page through that list, and nothing on the dashboard ever checks who’s looking.
Psst! How much do you know about protecting a car’s data, from trade-ins to opt-out rules? Flip these cards and find out.
5. What the Microphone Picks Up
A car’s built-in voice assistant records what a driver says every time it’s used.
That risk isn’t unique to cars.
The Federal Trade Commission’s general guidance on voice assistants is written for smart speakers, phones, and tablets, not for cars.
That guidance warns a device can start recording when it hears something that only sounds like the wake word.
The same risk applies inside a car.
It still records.
Many in-car systems then send that audio to the manufacturer’s servers for further review.
A driver rarely sees a prompt asking whether that’s fine.
6. Watching the Driver’s Eyes
Driver-facing cameras are becoming common in advanced car safety systems, and Cadillac’s Super Cruise is one of the most visible examples.
Cadillac’s Super Cruise system uses an infrared camera mounted on the steering column to track whether the driver is watching the road.
It runs the whole time the feature is engaged.
No separate prompt appears.
The system can tell if a driver glances at a phone instead of the road.
It responds with flashing lights, a vibrating seat, or an audible alert before shutting the feature off.
Competing systems from other automakers lean on steering-wheel sensors instead.
The camera approach is spreading fast across new models.
7. Seconds Before a Crash
A crash sets off automatic recording in many vehicles.
A built-in event data recorder, often called a black box, logs speed, braking, throttle position, and seatbelt use in the moments before and after impact.
It starts on its own.
Under the federal Driver Privacy Act, that recording legally belongs to the vehicle’s owner or lessee, not the manufacturer.
None of that changes when the recorder starts collecting data in the first place.
Who Can Pull That Recording
Your car’s black box data belongs to you by law, but five narrow exceptions let somebody else pull it anyway.
A court or government agency order is one way.
Your written consent for a repair or a subscription service is another.
Federal investigators can pull it too, when a federal investigation calls for it.
Emergency crews can also pull it to help respond faster after a crash.
Researchers studying traffic safety can use it as well, without needing consent or the owner’s name attached.
8. Your Psychological Profile
Some automakers write the possibility of psychological profiling directly into their privacy policies.
Nobody typed it in.
Mozilla’s 2023 review of automaker privacy policies found Nissan’s policy listing “psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes” among the traits it can collect.
That same review found the policy allows sharing that profile with data brokers and law enforcement.
That kind of profile typically gets built from ordinary driving data instead, the kind every trip already generates.
9. Your Engine’s Diagnostic History
A vehicle’s mechanical health goes on the record in close detail, too.
The vehicle’s telematics system logs mileage, fuel efficiency, battery condition, and engine fault codes automatically.
Nobody opts in first.
By 2024, companies like LexisNexis Risk Solutions had built businesses around packaging that diagnostic and driving data for insurers and other buyers.
Analysts project the market for monetizing car data could reach $750 billion by 2030, according to figures cited in the Mozilla Foundation’s review.
What Oregon’s Law Changes
Oregon lawmakers folded vehicle data directly into the state’s existing privacy law.
One law covers both now.
House Bill 3875 brought car manufacturers and their affiliates under the same rules that already covered other companies handling Oregonians’ personal data.
Under that law, Oregon drivers can ask an automaker to show them what it collected, correct it, delete it, or stop selling it for targeted advertising.
Is Dumpster Diving Legal in Oregon? Why the Bottle Bill Complicates the Answer
Oregon’s Bottle Bill pays out more than $200 million in refunds every year, and that cash pile sits right in curbside recycling bins.
Trespassing law, city rules, and the state’s redemption cap all complicate whether grabbing those bottles crosses a legal line.
Is Dumpster Diving Legal in Oregon? Why the Bottle Bill Complicates the Answer
15 Legal but Questionable Things You Can Do in the USA
Just because something is legal doesn’t mean it won’t earn a few strange looks.
Fifteen everyday habits stay perfectly within the law across the country, even when the neighbors clearly disapprove.
