There are some obvious sources like social networks and point-of-sale data, but some are less so. For example, that multimedia/navigation/emergency help system in your car can be routinely tracking your driving habits, and, possibly, sharing the data with insurance companies. Another recent (and controversial) source of the location data is the license plate tracking systems, implemented both by police and private companies.
There are immediate applications of this data to crime solving and vehicle repossession, but its marketing potential is enormous. If one can link it to the name of the person, one can pretty much get the picture of where, when, and how long a person works, spends at home, restaurant, gym, etc. Social network profile of that person could be even more valuable.
The most obvious link is the VIN-License plate-Name database, that both DMV as well as insurers can access. Save for the problem with common names, the link could probably be established. This data is, however, protected by the Driver’s Privacy Protection Act and its use is regulated.
The less obvious, but not improbable, link is pictures of cars on Facebook itself. How many of us proudly posted a picture of our new four-wheeled possession? If there is a license plate on it, it could be easily identified with the image recognition software and provide the missing part of the link. What would be an ethical thing for Facebook and others to do? I think, at very least, they should educate users about potential privacy implications of posting car pictures with license plates. BTW, Google Streetview blurs license plates and, probably, for a good reason.