The office keeps a register of the devices it issues, reviews the vendors who hold the family’s documents, and segments the networks at the residences, yet the cars sit outside all of it. They were bought through a dealer rather than procured, the paperwork went to whoever handles registrations, and nobody treated the delivery as the onboarding of a connected device that reports to a manufacturer.
A car is the only asset a family buys that arrives with its own cellular connection already fitted and a consent already collected, usually at a desk, usually in a hurry, by someone who was thinking about the finance terms.
What the cars collect
General Motors publishes a single privacy statement that, in its own words, “covers Personal Information that GM collects online and offline across all GM brands of products, services, websites and apps.” Those brands are Chevrolet, GMC, Buick and Cadillac, which means the statement governs the Escalade in the garage and the Suburban the security team drives.
The statement defines what it calls Driver Behavior Information as “information about how you drive a vehicle that is linked or reasonably linkable to you, such as vehicle speed, seatbelt use information, information about braking and acceleration habits, and related trip time and duration.” Seatbelt latch state is in there, which tends to surprise people who assumed the category meant speed and little else.
On cabin sensors GM is careful, saying it does not collect images or video from interior sensors, and then saying it “may collect data other than images or video that is derived from these sensors, such as when your vehicle detects a distracted or drowsy driver.” No picture is kept, and yet a judgment about the driver’s state still leaves the car.
GM defines location with unusual precision, stating that “Precise Geolocation is location information that identifies a location within a radius of 1850 feet,” and collects it while the vehicle is in use.
The pattern is not confined to American marques. Porsche’s notice, effective 1 September 2025, describes collecting “geolocation data, which may include real-time location data and/or GPS coordinates, accessed, collected, monitored, and/or remotely stored,” and separately describes collecting “video, still images, and traffic- and road-related data derived from images captured by outward-facing cameras integrated in your vehicle.” The same notice records that Porsche “disclosed within the twelve (12) months preceding the effective date of this Privacy Notice the following categories of Personal Information to other businesses or third parties for monetary or other valuable consideration: Identifiers and Commercial Information.”
How it leaves the car, and who receives it
The connection is built into the vehicle and does not depend on anyone’s phone. United States federal regulation defines a connected vehicle as one that integrates onboard networked hardware to communicate “via dedicated short-range communication, cellular telecommunications connectivity, satellite communication, or other wireless spectrum connectivity,” and enumerates the parts that do it, among them “networking or telematics units, cellular modem/modules” and “satellite communication systems.” A car of recent vintage is a device with its own subscriber connection, and leaving a phone at home changes nothing about that.
For one manufacturer, where the data goes next is a matter of public record. The United States Federal Trade Commission finalized an order against General Motors and OnStar on 14 January 2026, settling allegations that the companies “collected, used, and sold consumers’ precise geolocation data and driving behavior data” without adequately notifying consumers or obtaining their consent. The order runs for twenty years, requires GM to “obtain affirmative express consent from consumers prior to collecting, using, or sharing connected vehicle data,” requires a route for consumers to “request a copy of their data and seek its deletion,” and bans the company for five years from disclosing geolocation and driver behavior data to consumer reporting agencies. Consumer reporting agencies are the firms whose output insurers buy.
Research accepted for the 2026 ACM Internet Measurement Conference, conducted at Northeastern University with Consumer Reports, measured the wider pattern rather than asserting it. Across 21 late-model vehicles and 30 companion applications, the researchers found that 19 of the 21 vehicles contacted a third party over Wi-Fi, that 7 of the 30 applications sent personal information to trackers, and that 5 of those sent a vehicle identification number alongside it. Pairing the companion app with the car roughly doubled the vehicle’s exposure to advertising and tracking companies.
What switching it off does, and what it does not
The honest answer is partial rather than reassuring, which is where most coverage of this subject becomes unreliable. The first question is whether the switch exists at all. GM’s own statement says that “some model year 2019 and later vehicles may have an option to disable location services for OnStar,” which is a manufacturer telling owners that the control is a feature of certain cars rather than a right attaching to all of them. The FTC order reaches the same qualification from the regulator’s side, requiring GM to let owners disable the collection of precise geolocation “if their vehicle has the necessary technology.” A remedy imposed by a federal regulator still bends to what the hardware can do.
GM names two cases the switch does not reach. It states that if an owner disables location services, “we may still collect Geolocation Information from the vehicle in the event of an emergency,” and that “in limited circumstances GM may still collect Geolocation Information from a disconnected vehicle.”
The enrollment itself is contested. The State of Texas alleges, in a suit filed on 13 August 2024 that remains live and has already had some of its allegations struck on procedural grounds, that GM “compelled” customers to enroll in products including OnStar Smart Driver during vehicle onboarding and “told them that failing to enroll would result in the deactivation of their vehicle’s safety features.” That is a state’s pleading rather than a finding. The reason it matters even unproven is that it describes a pressure every owner will recognize from the delivery desk, where declining a connected service is presented as declining safety.
We recommend treating the opt-out as a reduction rather than a stop, asking each manufacturer in writing what collection continues after it, and keeping the answer with the vehicle record.
Whose car is it, and who else drives it
A family office car rarely has only one driver. The principal is driven, an estate manager runs errands in the same vehicle, a security lead takes it on a route survey, and an adult child borrows it for a weekend. The connected-services account, meanwhile, belongs to whoever sat at the dealership, which is frequently an assistant using a personal email address, and the registration may sit with an entity that has no natural person attached to it at all.
Manufacturers have noticed, and put the obligation back on the owner. Toyota’s connected services notice states plainly that the owner’s responsibilities include “informing passengers and drivers of your vehicle that data is collected and used by us.” A household with staff drivers is carrying that duty today for a group of people it has almost certainly never told.
Regulators are beginning to describe the same problem as a design requirement. France’s data protection authority recommended in June 2026 that manufacturers implement authenticated profile management so that several users of one vehicle can exercise their rights separately, and that an owner be able to disconnect a vehicle from a personal account remotely. Those two capabilities are the ones a family office needs and the ones it most often finds missing.
The day you sell it
Vehicles turn over faster than almost anything else the family owns, and a sale is an offboarding that nobody runs. GM’s advice to its own customers is direct: delete personal information before transferring a vehicle, because “if you do not delete this personal information, it may remain in the vehicle and may be accessible to future users of the vehicle.”
The FTC’s consumer guidance, dated 23 June 2022, lists what tends to be left behind, and one item on the list is not a privacy problem at all. Phone contacts and address books arrive when a handset is synced, mobile application logins persist, saved routes to home and office sit in the navigation system, and “garage door codes for your home or office may be on your system.” A car sold with a working garage code in it is a physical access failure, not a privacy one.
A vehicle bought used may still be attached to a previous owner’s account, and the office should assume it is until the manufacturer confirms otherwise.
What to build
- A vehicle register that records three things per car: the registered owner, the person holding the connected-services account, and the people who drive it. Most offices can produce the first and stall on the second.
- A delivery checklist, used before the paperwork is signed rather than after. What is enrolled, under which account, on which email address, and what declining each service costs in function.
- The manufacturer account in a named office role, not a personal inbox. An assistant who leaves should not take the family’s vehicle telemetry with them, and a trust-held car should not be tied to a departing employee.
- A written answer from each manufacturer on what continues after an opt-out, kept with the vehicle record so the question is answered once rather than argued about after an incident.
- Disposal treated as an offboarding event, with a factory reset, an account transfer or cancellation, and a check that no gate or garage code survives in the car.
- The people who drive briefed, because the duty to tell them already sits with the owner and because they are the ones who will notice a feature behaving oddly.
- Home and gate codes kept out of vehicle systems entirely, which costs nothing and removes the worst single outcome.
What to ask this week
Who is named on the connected-services account for each vehicle the family owns, and is any of them a former employee? When the last car was sold, did anyone reset it or cancel the account? If the family asked a manufacturer today for a copy of everything held about a vehicle, who would make that request and under which login? Which of the cars has a location setting that can be switched off, and has anyone looked? Is there a gate code or home address stored in any vehicle in the garage?
Where this sits
The exposure described here is the same kind cataloged in what is already public about your family, arriving through a channel that article does not cover, and the sequencing advice there applies before anything is spent here. The residence-side equivalent, where the family owns the asset but not the systems inside it, is the household perimeter. The account-ownership problem is the vehicle instance of the pattern in insider risk and the trusted positions nobody trains, where access grows quietly and is never re-run.
Building the register and the delivery and disposal checks into a program with named owners is cybersecurity program development. Keeping it current as vehicles, staff and manufacturers’ terms change is ongoing advisory.
Sources
General Motors, U.S. Consumer Privacy Statement, last updated 17 June 2026
Porsche, Privacy Notice, effective 1 September 2025