Three separate things are going on here: what your car's manufacturer already collects and sells about how you drive, what the next generation of "smart" road infrastructure is being built to read directly off new cars, and what your car has been silently broadcasting — new or decades old — the whole time.
TL;DR Your car's "driving score" became your insurer's risk score.
Modern connected cars log how you drive in detail — and for years, that log quietly became input to your insurance premium.
Hard-braking events, hard acceleration, speeds over 80 mph, average speed, what time of day you drive, how many miles, and where each of those events happened — captured continuously by the connected-services system your car shipped with.
Framed to the driver as a rewards or safety feature — points, discounts, a "driving report card" in the app.
Firms like LexisNexis Risk Solutions and Verisk compile the driving data into a report — the same kind of file used for background and credit checks, just for how you drive.
Often with no clear notice it happened, and — per multiple lawsuits — sometimes based on data drivers say was inaccurate.
A 2024 investigation found GM's OnStar "Smart Driver" program had shared driving data on millions of vehicles with LexisNexis and Verisk, which supplied it to insurers — reporting also named Honda, Hyundai, and Kia as running similar programs. Many drivers said they never knowingly enrolled. GM ended the program in April 2024 after the reporting and a wave of lawsuits.
Enrollment commonly happened through a rewards or safe-driving app signup, not a clear, separate disclosure that the data would reach insurance underwriting.
Check your car brand's connected-services or privacy portal and turn off "driving score," "smart driver," or "safety/rewards" style programs if you don't specifically want them running.
Request your consumer disclosure file from LexisNexis and Verisk. Because they function as consumer reporting agencies for this kind of data, US law entitles you to a free copy of what they hold on you — it's often the only way to find out you were enrolled at all.
TL;DR A funded federal plan to have new cars broadcast their position ten times a second.
Separate from telematics, there's a real, funded federal push to make every new car broadcast its position, speed, and heading directly to roadside infrastructure — sold as a safety upgrade, which in fairness it partly is.
Broadcasts a "Basic Safety Message" — position, speed, heading, braking status — roughly ten times a second, over a dedicated radio band, to any receiver in range.
Installed at intersections and along highways specifically to receive that stream, and in some deployments to talk back to the car.
The stated purpose is crash avoidance and signal timing. Nothing about the underlying data stream limits it to only that purpose once the infrastructure exists.
The US DOT's National V2X Deployment Plan targets V2X infrastructure on 20% of the National Highway System and V2X-enabled signals at 25% of intersections in the largest metro areas — both by 2028 — backed by federal grant funding for states and cities to build it out now.
In 2024 the FCC finalized rules dedicating a 30 MHz band at 5.9 GHz specifically to Cellular-V2X, the technology standard automakers are converging on for this exact broadcast.
Unlike an app-based telematics program, a V2X radio is part of the vehicle's safety systems. Turning it off isn't a settings-menu toggle the way declining a "smart driver" rewards program is.
TL;DR Even a 2007 car is trackable through walls — and nothing requires fixing it.
You don't need a connected car or a V2X radio to be trackable. Two systems already standard on almost every car made this century do the job on their own.
Required on virtually every US car since 2007. Each wheel's sensor radios a fixed, unique ID number to the dashboard, in the clear, roughly every minute — with no encryption and no authentication.
Phone-as-key systems and Bluetooth-paired infotainment constantly broadcast Bluetooth Low Energy advertisements to stay ready for keyless entry, discoverable by any BLE receiver within roughly 30 meters — the exact mechanism covered in the RF fingerprints page.
Once a TPMS ID or BLE identity is logged once, seeing it again anywhere confirms it's the same vehicle — building the same kind of movement history a license plate reader does.
A 2026 study out of IMDEA Networks Institute captured signals from over 20,000 vehicles over ten weeks, receiving TPMS IDs from as far as 50 meters away — and through walls, with no line of sight required. Unlike a license-plate camera, it needs no visual angle on the car at all.
Vehicle cybersecurity rules don't currently require TPMS signals to be encrypted or authenticated, despite the sensor's ID being permanent and impossible for an owner to change.
Honestly: not much on the TPMS side — it's safety-mandated equipment, not something you can disable, and no consumer-facing fix exists yet. That gap is itself an argument for why this needs a legal floor, not just individual workarounds.
On the BLE side, the same countermeasure research covered on the RF fingerprints page applies — it's the identical radio problem, just riding on your car instead of your phone.
That's the pattern across every page in this toolkit — collection that doesn't require consent, suspicion, or even use of the underlying service. It's also exactly what the amendment is written to require a warrant or explicit consent for.