Surveillance Data Harvesting

Bulk collection and sale of the data agents and devices gather.

The FTC barred GM and OnStar in January 2026 from sharing drivers' location and behavior data with consumer reporting agencies for five years. The US Justice Department has restricted bulk transfers of Americans' sensitive data to China and other countries of concern since April 8, 2025.

US bulk data rule thresholds: Personal identifiers 100,000; Health or financial data 10,000; Precise geolocation 1,000; Biometric identifiers 1,000; Human genomic data 100. Justice Department rule, 28 CFR Part 202 US BULK DATA RULE THRESHOLDS Personal identifiers 100,000 Health or financial data 10,000 Precise geolocation 1,000 Biometric identifiers 1,000 Human genomic data 100 PEOPLE OR DEVICES IN 12 MONTHS, LOG SCALE JUSTICE DEPARTMENT RULE, 28 CFR PART 202
Americans in Arity driving data
45M+
GM data-sharing ban
5 years
Gravy Analytics data claimed
17 TB
Registry incidents
1

Evidence

Car and app data reached insurers and brokers without drivers' knowledge

Documented cases: surveillance Data Harvesting
DateCaseCountryWhat happenedSource
Jan 13, 2025Texas v. Allstate and ArityUnited StatesFirst suit under a state comprehensive privacy law over driving data from other appsSource
Jan 2025Gravy Analytics and VenntelUnited StatesFTC location-data ban; a breach exposed app location dataSource
May 6, 2025CAC app and SDK noticeChina15 apps and 16 SDKs cited for illegal personal data collectionSource
Jan 2026FTC order against GM and OnStarUnited StatesLocation captured as often as every 3 seconds, sold without consentSource

Registry

One registry incident involves surveillance data harvesting

Registry incidents meet a stricter bar than the cases above: public sources name the developer, the failed control and who found it.

Registry incidents linked to this risk
IncidentDateAgentControl that failed
Tesla Staff Share Customer Car Camera Footage2019 to 2022Vehicle camera data pipelineEmployee access to customer recordings

Exposure

12 of 17 agent types rate very significant or critical on data capture and retention

From the attack surface ratings, the agent types where this risk has the widest path in.

Agent types most exposed
Agent typeDimensionRating
Ambient sensorsData capture and retentionCritical
Robotaxis and autonomous vehiclesData capture and retentionVery significant
DronesData capture and retentionVery significant
Fleets and swarmsData capture and retentionVery significant
Phones and tabletsData capture and retentionVery significant
WearablesData capture and retentionVery significant
Vehicle cabin AIData capture and retentionVery significant
Smart home assistantsData capture and retentionVery significant
Medical devicesData capture and retentionVery significant
Public infrastructureData capture and retentionVery significant
Workflow agentsData capture and retentionVery significant
Enterprise agentsData capture and retentionVery significant

Controls that bound it

Rules

The US now restricts bulk data flows to China; China enforces through app reviews

Rules that address surveillance data harvesting
RuleJurisdictionWhat it requiresStatus
Justice Department Data Security ProgramUSBans or restricts bulk sensitive data deals with countries of concernEffective Apr 8, 2025
PIPL and network data security regulationsChinaConsent, minimization and transfer controls2021 and 2025
Texas Data Privacy and Security ActTexasConsent for sensitive data including locationEffective Jul 1, 2024

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Risk group
Data Risks
Datasets
ai_risk_evidence.csv (4 rows); registry incidents (1 linked); ai_attack_surface.csv
Key sources
Texas v. Allstate and Arity
Gravy Analytics and Venntel
CAC app and SDK notice
FTC order against GM and OnStar
Last verified
October 2026