Location as a commodity: license plate readers, telematics, and the market for your car's movements
Two parallel systems now record where most vehicles go. Roadside cameras photograph every passing license plate, and connected cars stream their own position back to the manufacturer. Both feed commercial databases, and neither requires the driver to do anything wrong. The past two years have produced enough enforcement action, litigation and leaked audit data to show how this pipeline works, who buys from it, and how often it gets abused.
A plate-reader network that searches itself
Flock Safety, the market-leading US vendor, holds more than 120,000 automatic license plate recognition cameras on poles and intersections, according to the ACLU. EFF obtained audit data covering over 12 million searches by more than 3,900 agencies between December 2024 and October 2025, and found that one query can fan out to 83,345 cameras nationwide; a single Texas search probed 6,809 agency networks at once. In San Jose, police and partner agencies searched the city's own database nearly four million times in a year without warrants, the core of a lawsuit EFF filed with the ACLU of Northern California. The sharing mesh also grows by default. Wired documented how Alpharetta, Georgia, a suburb of about 67,000 people, came to exchange plate data with more than 2,000 organizations, automatically approving requests from any agency within 500 miles; some agencies discovered nationwide lookup had been switched on for years without their knowledge. The endpoints leak too. When a hacker collective pulled a Flock camera off its pole and copied the storage, Wired and 404 Media reported roughly 50,200 vehicles photographed in three weeks of logged activity, about 28 images per vehicle, with plates read on Flock's servers and the software flagging people as well as cars.Telematics: the car volunteers the rest
Plate readers catch vehicles in public; telematics skips the road entirely. In January 2025 the FTC moved against General Motors and its OnStar subsidiary over a misleading enrollment process for the Smart Driver program, under which precise geolocation, in some cases recorded as often as every three seconds, plus driving behavior data, was sold to consumer reporting agencies. Insurers relied on those reports when setting rates or denying coverage, and many drivers learned of the practice only when their premiums reflected it, according to the FTC. The finalized order, announced January 14, 2026, bans GM from disclosing geolocation and driver behavior data to consumer reporting agencies for five years and imposes a 20-year consent order requiring express consent for connected-vehicle data collection, consumer access and deletion rights, and working opt-outs, per the FTC. GM is one automaker. Mozilla Foundation's car privacy review handed its warning label to all 25 brands it examined and called cars the worst product category it had ever reviewed for privacy.Abuse is documented, not hypothetical
An Alpharetta patrolman searched his ex-partner's plate 56 times in three months, another officer's vehicle 29 times, and a relative's plate 18 times, usually logging the reason as Wanted Person or Traffic Infraction. Asked about the dropdown choice, he called itjust a quick keystrokebefore resigning in August 2026. Wired counts at least 45 documented incidents of officers using the system to track current or former romantic partners. That is the domestic violence pattern in its purest form: state infrastructure repurposed as a stalking tool by someone with a login. The misuse is not only romantic. EFF's audit found hundreds of searches tied to political protests, more than 80 agencies running searches containing ethnic slurs or stereotypes, Texas deputies framing an abortion investigation as a missing-person query, and Customs and Border Protection reading Illinois camera data in violation of state law.
What opt-out actually covers
Under pressure, Flock announced changes in August 2026: a recommended seven-day retention window instead of thirty, mandatory case numbers for searches, and audit tooling. About 90 percent of searches happen within a week of the scan anyway, and more than 200 agencies have canceled contracts, per the ACLU. EFF's verdict on this reform cycle was that the abuses "stem from the architecture itself", not from any single agency's misuse.- A GM-style opt-out governs your own car's future data feed. It cannot claw back what was already sold, and it binds one manufacturer out of dozens.
- No opt-out exists for your plate. Any camera owned by any participating agency, homeowners association or business records it the moment you drive past.
- Deleting your telematics history does nothing about the rental car, the borrowed car, or the passenger seat.
- Agency-to-agency sharing, the setting that let one suburban department reach 2,000 organizations, is a contract option, not a consumer setting.