Vehicles, Travel and Trackers

A car is a rolling computer with your home address in its GPS history, and a coin-sized tag dropped in a bag can report where you sleep. The first half of this lesson is about who collects that, how, and what has gone wrong. The second half is what to do about it, level by level.

The threat: who is watching on the road

What a connected car collects, and who bought it

A connected car has its own cellular connection, separate from your phone. That is how remote start, crash alerts and the maker's app work, and it can report whether or not you ever pair a phone. That stream is called telematics. Where it goes depends on what you agreed to, often in an enrollment screen you saw once.

The FTC's case against General Motors shows the plumbing. According to the agency's complaint, GM collected precise location (latitude, longitude, heading, speed and a time stamp) "every three seconds, starting from ignition on," tied to the car's VIN. The program grew from about 500,000 vehicles to roughly nine million. A separate feed, OnStar Smart Driver, logged hard braking, hard acceleration, seat belt use and speeding over 80 mph. GM sent driver behavior data, with names and addresses, to Verisk under an agreement amended in December 2016, and to LexisNexis Risk Solutions under a contract from August 2019. Location data was also licensed to Wejo, a British connected-car data company, which sublicensed it for uses such as outdoor advertising analytics.

Those buyers matter because both are consumer reporting agencies. The FTC said such agencies used the data in reports that insurers used "to deny insurance and set rates." It said GM's enrollment was "confusing and misleading," that drivers were told the data would help them assess their own driving, and that some did not know they had been signed up at all. GM ended the agreements in March 2024 and dropped Smart Driver that June. These were allegations, and GM settled. The final order, approved January 14, 2026, requires GM to get "affirmative express consent" before collecting, using or sharing connected vehicle data, to let all U.S. consumers request a copy of their data and its deletion, and to let owners turn off precise location where the car allows it. GM is banned for five years from disclosing location and driving data to consumer reporting agencies. The order runs 20 years and keeps an exception for location sent to emergency responders.

GM was the case that got caught. The CFPB's list of consumer reporting companies includes LexisNexis C.L.U.E. and Telematics OnDemand and notes that some companies in that category "may also share your driving behavior data with auto insurers." Because these are consumer reporting companies, the Fair Credit Reporting Act gives you the right to see your file.

Rental cars, tolls and loyalty programs

A rental car remembers the last driver. The FTC warns that a paired phone can leave call logs, messages and GPS destinations behind, where the next renter may find them, and that a USB cable can transfer data even when you only want a charge.

Toll transponders log each time you pass a gantry, and pay-by-plate tolling photographs your plate. Airline and hotel loyalty programs keep a travel history tied to your name. Breaches turn that history into someone else's file. The FTC's October 2024 action against Marriott and Starwood covered breaches from 2014 to 2020 that affected more than 344 million customers worldwide. One exposed 339 million guest records, including 5.25 million unencrypted passport numbers. Another exposed 5.2 million guest records, 1.8 million of them Americans, with names, addresses, phone numbers, birth month and day, and loyalty account details. Marriott also paid $52 million to 49 states and the District of Columbia. The FTC order requires a link where U.S. customers can ask for deletion of their personal information, tied to an email address or loyalty number.

Hidden trackers and the people who plant them

The Bureau of Justice Statistics estimates 3.4 million people age 16 or older were stalked in 2019. In its report, 80.1 percent were stalked with technology, and about 14 percent of those were tracked with an electronic device or app. Most victims, 67 percent, knew their stalker, and about a quarter were stalked by a current or former intimate partner. Women were stalked at more than twice the rate of men. Less than a third of victims reported it to police.

There are two kinds of tracker, and they need different defenses. A Bluetooth tag such as an AirTag has no GPS or cell radio of its own. It broadcasts a signal that nearby phones pick up and report to the owner, so it works best in crowded places. In February 2022 Apple acknowledged "reports of bad actors attempting to misuse AirTag," added earlier alerts and louder sounds, and noted that every AirTag has a serial number tied to an Apple ID, which Apple can provide to police in response to a valid request. A GPS unit is the older kind. It finds its own position and reports over a cellular connection. In 2018 a former Ohio state trooper was sentenced to 24 months in federal prison for cyberstalking after placing a GPS device on a victim's vehicle and watching her location in real time, according to the U.S. Attorney's Office.

Since May 2024, iPhones and Android phones can warn you about each other's Bluetooth trackers. Apple and Google wrote a shared specification, Detecting Unwanted Location Trackers, and Apple shipped it in iOS 17.5 while Google launched it on Android 6.0 and later. Several tag makers, including Chipolo and Pebblebee, committed to compatible tags. The IETF now has a working group standardizing it, with rules for how tags announce themselves, how a phone can make one play a sound, how to get disabling instructions, and how to shut nonconforming tags out of the finding networks. Older or off-brand tags may not be covered, and no phone alert is built to catch a cellular GPS unit.

Your devices at the border

Border crossings are where your devices get the least legal protection. CBP says all travelers crossing the border are subject to inspection, and that includes phones and laptops. CBP's numbers, from its own page: 55,318 travelers had their devices searched in fiscal year 2025, out of more than 419 million processed, which is under 0.01 percent. Searches are rising. The first three quarters of fiscal 2026 already reached 52,081.

CBP's rules, as it states them: a basic search is a manual look. An advanced search, where equipment copies or analyzes the device, needs reasonable suspicion or a national security concern and a senior manager's approval. Officers disable network connections first and "may not use the device to access information that is solely stored remotely." Information CBP keeps can sit in its Automated Targeting System for up to 15 years.

How to reduce it

Level 1 Everyday

Tracker alerts are the first defense against a planted Bluetooth tag, and they cost nothing. They answer one threat well: an AirTag, Find My accessory or compatible tag moving with you. They do not catch a cellular GPS unit, and they can lag (EFF's tracker guide says up to 24 hours), since a phone needs time to decide a tag is following you and not just near you. And yes, on iPhone they ask you to turn on a location feature to catch location tracking. That is the trade.

If an alert arrives, the response is quick to learn. Turning off Bluetooth or Location Services on your phone does not help. Apple says that does not stop the owner from seeing the tag's location. Disabling the tag does. But disabling also tells the owner something changed, which matters if the owner is a partner or ex.

Rental cars are the other Level 1 habit. Charge from the lighter socket with an adapter, since the FTC warns USB can move data. If you pair by Bluetooth, grant only what you need; the FTC's example is that music playback does not need your contacts. Before you return the car, open its settings, find your phone in the paired devices list and delete it, and clear any addresses you typed into the GPS. Two minutes at drop-off keeps your call log and the route to your house out of the next renter's hands. It does nothing about the rental company's own telematics, which you do not control.

Level 2 Careful

Your own car may report more than any rental. Turning off location sharing and driving scores answers the GM-style threat directly: data that is never collected cannot be sold to a reporting agency. Requesting your file answers the part already done, because it shows whether driving data has reached the companies insurers check. The cost is real. Remote start, the maker's app or automatic crash response may stop working, so ask the maker what you lose before switching everything off. None of this touches plate readers or tolls.

Hand checks are for the threat alerts miss. With a flashlight, look under bumpers, inside wheel wells, under seats, in the glove box and trunk, and in the seat pockets. Empty every pocket of the bag you carry daily, including the lining. If you find a device, photograph it where it sits before touching it, because a GPS unit and its placement are evidence.

Level 3 Private

The travel trail is mostly optional fields. An email alias for bookings and loyalty accounts (see Browsing, Search and Email) keeps a breach from tying your trips to your main inbox. Skip birthday, home address, companions and preferences in profiles, and decline marketing and partner sharing in each account's privacy settings. If you have stayed with Marriott, its deletion link exists because of the FTC order. Pay cash at a toll booth where one still exists, or accept the transponder record as the price of the fast lane. What you cannot trim is your name: your airline ticket has to match the ID TSA checks, so never try to fly under another name. Cost: lost points and slower checkouts.

Level 4 Hardened

Border prep answers one threat, a device search at a port of entry, and its main tool is leaving data at home. It does not stop a search, and CBP may hold a device it cannot inspect. EFF's guide to crossing the U.S. border covers more choices.

More travel planning: Device Security and Travel.

Level 5 Hyper-vigilant

Travel with a separate phone and laptop that hold nothing but the trip, signed into accounts made for the trip. Treat any device that left your sight in a hotel or at a checkpoint as suspect, and reset it at home. The weak point is you: one familiar login or one loyalty number links the travel identity back. Lesson 9 covers how that happens.

The ladder for this topic