Because "spying" in this case means "sending data to the mothership."

It doesn't mean "the car's gps is disabled"

Perhaps. But what if a person living in Massachusetts travels to another state?

I found this when looking into it more: https://arstechnica.com/cars/2023/06/feds-tell-automakers-no...

"Now, according to Reuters, NHTSA has written to automakers to advise them not to comply with the Massachusetts law. Among its problems are the fact that someone “could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently,” and that “open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking.”

Faced with this dilemma, it’s quite possible the automakers will respond by simply disabling telematics and connected services for customers in the state. Subaru already took that step when it introduced its model year 2022 vehicles, and NHTSA says other OEMs may do the same."