Here's what I found

[UpInArms]

https://engineerfix.com/do-new-cars-have-gps-trackers/

Dealer-installed devices, in contrast, are generally simpler hardware added after the vehicle leaves the factory. These are often small, plug-in modules placed in the On-Board Diagnostics (OBD-II) port, or hardwired “starter interrupt” devices used primarily for inventory management or subprime financing. These interrupt devices, which can remotely prevent the vehicle from starting, are installed to mitigate financial risk and are a separate category from the more comprehensive data collection performed by the factory-equipped TCU.

…

The extensive data collection facilitated by telematics raises significant questions about privacy, data ownership, and the ability of the consumer to opt-out. For factory-installed systems, physically disabling the TCU is difficult and can void warranties or impair safety features like ACN. The primary method of control is through the in-vehicle infotainment menus or the connected services application, where manufacturers often provide a “Privacy Mode” or a setting to decline “Master Data Consent”. However, opting out of data sharing frequently results in the loss of all associated connected services, including remote start and real-time navigation.

A major concern involves the practice of automakers sharing specific driving data with third-party data brokers, such as LexisNexis and Verisk. This data, which includes records of speeding and hard braking events, is used by the brokers to create detailed consumer reports and risk scores that are then sold to auto insurance companies. Consumers have reported significant insurance premium increases or even denial of coverage based on these telematics-derived reports, often without realizing their driving data was being monitored and shared.