They Didn't Read Your Texts. They Just Kept Them.

Nobody has to take it from you. They just have to keep a copy you aren't allowed to touch.

The Video

The video this post is answering: Car Coach Reports, “Court Rules Automakers CAN Record and Intercept Your TEXT Messages!”

Watch it. Then let me fix the headline.

What the Court Actually Said

Five related class actions were filed by Washington residents under the Washington Privacy Act. The core allegation in the Honda case: starting with 2014 models, the infotainment system pulled a copy of every text message off any phone paired to it and stored it in permanent memory, in a way the owner could not access or delete.

The complaint also named Berla, a Maryland company that makes forensic equipment built to extract stored messages from infotainment systems. Per the lawsuit, that tool isn't sold to the public. It is sold to law enforcement.

So picture it: a copy of your private messages, sitting in a box bolted into a car you paid for, readable by the manufacturer's tooling and the police, and by everyone except you.

On November 7, 2023, a Ninth Circuit panel affirmed dismissal of all of it in unpublished memorandum decisions. The reasoning fits on an index card. Washington's privacy statute requires a plaintiff to show injury to “his or her business, his or her person, or his or her reputation,” and the court held that a bare violation of the act is not enough.

Read that slowly. The court did not find that the cars weren't copying texts. It did not find the copying was lawful. It explicitly declined to decide whether the statute even reaches manufacturers, because the injury question ended the case first.

“Court rules automakers CAN” is a clickbait frame. The accurate headline is uglier: you can be surveilled by your own property, and the law shrugs until you can show a dollar figure, a broken bone, or a ruined reputation. For a harm that, by design, you cannot see.

That is not a privacy law. That is a privacy law with the battery pulled.

The “Safety” Excuse

Here is the part that makes my eye twitch.

The pitch for wiring your phone into the dashboard is safety. Hands on the wheel, eyes on the road, let the car read your messages out loud. I don't object to that feature. I object to the bait-and-switch hiding behind it.

Reading a text aloud requires the car to see it for a few seconds. It does not require the car to keep it forever. I have spent nearly 30 years in enterprise IT and endpoint security, and there is no engineering reason a read-aloud feature needs to write your message history to permanent storage, let alone storage the owner can't wipe. Transient access does the job. Retention is a choice somebody made, and “safety” is the word they put on the box.

If a laptop in your house silently copied every message on your phone the first time you plugged in a charger, we would call it malware. Put it behind a steering wheel and we call it a feature.

This Isn't Theoretical Anymore

If the text-message case feels abstract, the GM case is not.

GM's OnStar Smart Driver was marketed as a free tool to encourage better driving. According to the FTC, GM collected drivers' geolocation and driving behavior, sometimes as often as every three seconds, and sold it to data brokers including LexisNexis and Verisk, which packaged it for insurance companies. One reported driver saw her premium jump 80 percent after GM shared hundreds of trip records from her car.

After a New York Times investigation in March 2024, GM killed the program that April and cut ties with both brokers. In August 2024, the Texas Attorney General sued GM, alleging data from more than 1.8 million Texans was collected and sold without consent. And in January 2026, the FTC finalized a 20-year order that bans GM from sharing that data with consumer reporting agencies for five years and requires opt-in consent going forward. No fine.

The fine came from the states instead. On October 29, GM agreed to pay $220 million to 36 attorneys general over the same program. The money goes to the states, not to the drivers whose data was sold.

Five years. Then what? And both orders bind one manufacturer. Every other brand in your driveway is operating on the honor system.

Mozilla looked at 25 car brands in 2023 and every single one failed its privacy review. Cars were the worst product category it had ever tested.

The Right to Own Test, Data Edition

Post one gave you one test for any rule or product: does it extend the usable life of the thing you own, or shorten it?

Data needs a sister test. Three questions:

1. Can you see it?
2. Can you delete it?
3. Can you say no to it, without losing the feature you paid for?

The infotainment systems in that lawsuit fail all three. The GM program failed all three until a regulator forced the issue. If you own a thing but can't see, delete, or refuse what it records about you, you don't fully own it. You're hosting someone else's sensor.

What to Do This Week

Practical first, because sandbags still keep your feet dry.

• Pair for audio, not for access. When your phone asks whether the car can sync contacts or show messages, say no. Calls and music work without it.
• Never pair a rental, loaner, or friend's car. Use a cable for charging only, or don't connect at all. If you already did, delete your phone from the head unit before you hand back the keys.
• Assume a factory reset may not purge everything. The whole lawsuit was about data the owner couldn't delete. Buying or selling used? Reset anyway, and don't trust it.
• Dig through connected services settings. Opt out of data sharing, telematics “insurance programs,” and anything with “Smart” or “Score” in the name.
• Pull your broker files. They're free. Under federal law you can get one free LexisNexis consumer disclosure report every 12 months at consumer.risk.lexisnexis.com, and Verisk has its own driving data disclosure form. Karen and I are requesting ours. If you find something wrong, the Fair Credit Reporting Act gives you the right to dispute it.

Back the People Doing the Work

Personal hygiene helps you. It doesn't fix the law. Organized people fix the law.

• Consumer Rights Wiki. consumerrights.wiki is a community-edited database of anti-consumer practices that Louis Rossmann founded in January 2025, now run under the nonprofit FULU Foundation. As I write this, its automotive category has three pages. That is a gap with your name on it. Document what your car does. Cite your sources. Make the record harder to ignore. They also make a browser extension that flags products and companies with a documented history.
• Louis Rossmann. He has spent years testifying in statehouses for right to repair while running an actual repair shop. Watch his channel, share it, and support FULU.
• EFF, iFixit, and Repair.org. Same names as last time, because they're still pulling in the same direction.
• Call your state legislators. Washington's problem is one sentence in one statute. Ask yours a simple question: if a company records my private messages without consent, do I need to prove damage before I can sue? If the answer is yes, ask them to fix it with statutory damages. State offices count calls in single digits. You are not one of ten thousand.

Why I'm Telling You This

In post one I wrote that what's actually running out is permission. Permission to buy a part, hire a mechanic, receive a patch.

This is the same story pointed inward. Your car didn't need permission to copy your messages, and the court says you need permission, in the form of provable harm, to object. The burden is on the owner. The convenience belongs to the manufacturer.

They didn't read your texts. They just kept them. And they'll keep keeping them until enough of us make that more expensive than stopping.

Get loud with me.

Sources & Further Reading

• Car Coach Reports, “Court Rules Automakers CAN Record and Intercept Your TEXT Messages!”, the video this post answers. Its headline is corrected above.
• Ninth Circuit memorandum decisions, November 7, 2023, not for publication, affirming dismissal of the Washington Privacy Act claims, e.g. No. 22-35448 (Honda) and No. 22-35454. The companion Ford case, Jones, was decided earlier.
• Reporting on the ruling and the Berla allegations: The Record, The Register, Malwarebytes.
• FTC and GM/OnStar: the January 2026 final order, via TechCrunch and Repairer Driven News; the reported premium increase via Techlicious.
• GM multistate settlement (Oct. 29, 2026): $220 million to 36 attorneys general, via the Maryland Attorney General and TechCrunch.
• Texas v. General Motors, filed August 2024 in Montgomery County, via Texas Standard.
• Mozilla Privacy Not Included, 2023 review of 25 car brands.
• LexisNexis FACT Act disclosure: consumer.risk.lexisnexis.com/factact.
• Consumer Rights Wiki: consumerrights.wiki, and its Automotive category.
• Previously in this series: “They Didn't Take It From You. They Made It Too Expensive to Keep.”

Sourcing note: The text-message allegations above are allegations from the complaints; the court dismissed on the injury requirement and never ruled on whether they were true. The Berla law-enforcement detail comes from the lawsuit as reported. The status of the Texas suit is described as of filing. The engineering point about transient access versus retention is my professional opinion, informed by nearly 30 years in IT and security. I am not an attorney. Verify anything you plan to repeat.

Connect with Casey

Have a story, a question, or want Casey to write about a specific topic? DM me and tell me which story you want next.

Casey writes about economic policy, nomadic life, cybersecurity, and navigating the world as a late-diagnosed AuDHD adult. New posts drop on my professional website.