Why It Matters

Modern vehicles gather geolocation information through GPS systems, telematics control units, electronic control units, dedicated short-range communications radio, and third-party monitoring devices. Manufacturers collect vehicle geolocation data for navigation and emergency response, and use it for targeted marketing; insurers access it to set personalized rates; data brokers buy it for market research; and law enforcement obtains it via warrant, subpoena, or direct purchase from brokers.

A recent Congressional Research Service (CRS) report, published June 30, examines how modern vehicles collect and share precise location data, revealing regulatory gaps that could expose Americans to stalking, foreign surveillance, and discrimination, while leaving Congress with limited legislative options.

Location tracking can reveal sensitive personal information including religion, sexual orientation, health conditions, and marital status. Foreign adversaries might access this data to target military and government personnel. Tracking a consumer's location via vehicle geolocation data may create stalking risks and domestic violence risks. Yet, Congress has not passed comprehensive federal data privacy legislation, and no existing federal laws specifically regulate the collection, processing, and use of vehicle geolocation data.

The Big Picture

The regulatory landscape is fragmented. The Federal Trade Commission (FTC) has authority over unfair and deceptive practices and can limit foreign adversary access. The National Highway Traffic Safety Administration has limited geolocation-specific authority. The Federal Communications Commission maintains a covered equipment list of national security risks and proposed a rulemaking to allow domestic abuse survivors to disable connected vehicle services. The Department of Justice issued a January 2025 rule restricting bulk transfers of precise location data to foreign adversaries. As of June 2026, however, the FTC has not taken action against any companies for violating relevant provisions of existing law regarding vehicle data.

The report identifies five major categories of risk and concern:

  • Sensitive location tracking
  • Data overcollection and retention
  • Consumer awareness and consumer choice issues
  • Data brokers' access
  • Data disclosure to law enforcement or other governmental entities

Researchers can re-identify individuals by cross-referencing timestamps, social media posts, IP addresses, and known nearby facilities.

The Bottom Line

H.R. 8413 would limit risks associated with the collection and exchange of consumer data by regulating data brokers or vehicles; H.R. 6734 could cover the access, sale, and exchange of vehicle data, including geolocation data; and H.R. 2110 would allow domestic-abuse survivors to disable connected vehicle technologies.

Access the Legis1 platform for comprehensive political news, data, and insights.

Spot something wrong? Report an issue with this article