Most navigation systems are separate from a car's computers and cannot track your location. Nav systems rely on the Global Positioning System, which is a one-way data stream to the car. Your car may know where it is, but nobody can track it via the GPS link, and no location data is stored in the EDR.

But everything changes when you add a cellular connection. Cars equipped with telematics systems such as OnStar or Hyundai Blue Link have two-way links to service providers that relay GPS data. The operators of these services do, indeed, have the ability to see where you are, how fast you're going, and what state your car is in mechanically. They can also track and remotely disable a stolen vehicle. The Nissan Leaf uses a similar two-way connection to regularly send data on usage and location to Nissan, which the company uses for future electric vehicle development. But these services aren't supposed to work without driver permission. The car can initiate a call in an emergency situation, such as when an airbag is deployed, but otherwise the driver must authorize an external connection to the vehicle.

Companies have been caught snooping, though. OnStar found itself in the midst of a public uproar last September when it quietly changed contract terminology and started tracking customers with the intent of selling information about their driving habits. OnStar reversed the policy under pressure from consumers and Congress. Recently, insurance companies Progressive and State Farm have begun testing tracking systems, which policyholders plug into their OBD-II port. The systems record data on driving habits, and in exchange customers can potentially get lower insurance premiums, but any data collected belongs to the insurer (including any crash data).

What can you do about it? If you're a new-car buyer, not much. But pay close attention to the language of the user agreement for any telematics service—if you don't like what you read, opt out of the service. With EDRs, it's enough simply to know your rights. The law is still playing catch-up to the technology, but at this point you do not have to surrender the EDR data to the police without probable cause, a warrant, or a subpoena.