Your Car Has Been Selling Your Driving Data to Insurers

In May 2026, California Attorney General Rob Bonta and partner district attorneys announced a $12.75 million settlement with General Motors, subject to court approval, over allegations that GM sold driving and location data from hundreds of thousands of California drivers to data brokers Verisk Analytics and LexisNexis Risk Solutions. The California DOJ said GM made roughly $20 million nationwide from those sales between 2020 and 2024.

Most new cars sold in the United States now carry telematics systems. According to the FTC's complaint, GM and OnStar collected location data from some drivers as often as every three seconds. GM and Allstate are among the automakers, data brokers and insurers that built a data pipeline. The pipeline routes data from drivers' daily trips to insurers, who use it for pricing. Regulators in California, Texas and at the federal level say the enrollment and disclosure processes used to build that pipeline were unclear or misleading.

GM and Allstate built the two main pipelines that move driving data from vehicles to insurers: automaker telematics systems feeding data brokers directly, and third-party apps embedding tracking software on drivers' phones. The diagram below shows how both pipelines work, based on the FTC consent order against GM, the Texas AG lawsuit against Allstate and Arity, and LexisNexis product documentation.

GM's OnStar Smart Driver program was the clearest early example of automakers piping data directly to brokers. OnStar collected geolocation and driving behavior data from millions of vehicles and sold it to LexisNexis and Verisk. The FTC's January 2026 consent order against GM settled allegations that the company used a misleading enrollment process and didn't clearly disclose its data collection and sales practices. A case first reported by The New York Times illustrated the scale: one driver's LexisNexis consumer disclosure report ran 258 pages and logged 640 individual trips, with start and end times, distance traveled, speeding events, hard braking and fast acceleration all recorded.

Allstate's subsidiary Arity shows how the second pipeline works: tracking software embedded inside third-party apps. The Texas Attorney General's January 2025 lawsuit against Allstate and Arity alleged that Arity's software development kit was embedded in apps including Life360, GasBuddy, Fuel Rewards and Routely. According to the lawsuit, Allstate paid app developers millions of dollars to integrate the SDK, and consumers unknowingly downloaded the tracking software when they installed those apps. The Texas AG called the suit the first enforcement action brought by a state attorney general under a state data privacy law. The lawsuit also alleged that Arity collected trillions of miles of location data from more than 45 million Americans.

LexisNexis Risk Solutions and Verisk receive data from both pipelines and sell driver behavior scores to insurance companies. LexisNexis packages that data through its Telematics OnDemand product, which it markets as an exchange connecting automakers and insurance carriers; as of 2026, LexisNexis says the exchange draws from U.S. automakers, mobile apps and other third-party sources. Verisk took a different path: after the FTC's enforcement action against GM and the resulting media coverage, Verisk shut down its driver behavior product and exited the insurer data market.

The Maryland Insurance Administration's 2025 survey of 16 insurers found that telematics systems can track speed and speeding events, hard braking, rapid acceleration, cornering, time of day driven, miles driven, phone use while driving, trip start and end locations, idle time, turn signal use and altitude. Insurers use different combinations of these data points depending on the technology.

App-based programs collect the most data because they combine trip detection, phone sensors, route data and phone-use signals. Some telematics apps require 24/7 location access on drivers' smartphones, not just while the vehicle is moving. Plug-in devices installed in the vehicle's OBD-II port generally avoid phone-level permissions like always-on location access but still record core driving behaviors.

More than 70% of Americans say they're worried about being tracked, according to Pew Research Center, and connected vehicles have become a focal point of that concern. Accuracy is also a problem: in J.D. Power's 2025 U.S. Auto Insurance Study, only 38% of customers said the driving data collected by their insurer is always accurate. Journalists covering telematics can find a program-by-program breakdown of what each system monitors in MoneyGeek's guide to telematics car insurance.

Only 31% of Maryland telematics policyholders saw premium decreases at renewal, according to the Maryland Insurance Administration's 2025 report. Insurers advertise discounts of up to 40%; audited renewal data from Maryland puts the share of policyholders who saw savings at less than a third. The chart below compares renewal outcomes across the Maryland dataset and a national consumer survey.

The best-case national figure comes from TransUnion's 2022 consumer survey of 2,761 U.S. consumers with active policies, in which 48% of enrolled drivers reported rate decreases and 30% saw no change. That survey draws on drivers describing their own experience rather than verified policy records, which puts the 48% figure in a different category than state regulator data.

The Maryland Insurance Administration's 2025 report covers actual renewal outcomes for 263,703 telematics policies. Of those, only 31% saw premiums fall. About 24% saw increases, and 45% saw no change. Maryland had 303,845 policies enrolled in telematics programs out of 2,296,713 total policies statewide. The Consumer Federation of America, which analyzed the Maryland report, concluded that telematics savings are a mirage for many drivers, or are at least exaggerated. Maryland is also one of the states where rate impacts from telematics data can legally occur, unlike California, where state law prohibits insurers from using driving data to set rates.

One is a national self-reported survey. The other is a single state's verified renewal data. The gap between them is what journalists covering insurance affordability should report.

Allstate, GEICO, Liberty Mutual, Progressive and Travelers reserve the right to raise rates based on telematics data. American Family, Farmers, Nationwide, State Farm and USAA market their programs as discount-only, meaning poor driving scores reduce or eliminate the discount rather than trigger a surcharge.

Programs marketed as discount-only, including Nationwide's SmartRide and State Farm's Drive Safe & Save, can lose that discount at renewal if driving data shows risky behavior. The discount, in other words, can still function as a penalty.

Telematics adoption remains limited despite the growing premium pressure on drivers. Only 17% of insurance shoppers buy a usage-based policy, according to J.D. Power's 2025 study, though that share rises to 26% among new customers. Adoption roughly doubled between 2016 and recent years but has plateaued. For journalists reporting on why drivers skip these programs, rate comparison data from insurers with the lowest car insurance rates shows how much room exists to save without giving up driving data. 

Journalists covering affordability can benchmark telematics program outcomes against MoneyGeek's analysis of the best car insurance companies by rate, coverage and customer satisfaction to show readers whether a telematics discount moves the needle.

The FTC, California Attorney General and Texas Attorney General have taken enforcement action against automaker and data broker practices since 2024, and state legislatures in at least three states have moved to ban the sale of precise geolocation data.

The FTC finalized a consent order against GM and OnStar in January 2026. The order imposes a five-year ban on sharing geolocation and driver behavior data with consumer reporting agencies. For the full 20-year life of the order, GM must get affirmative express consent before collecting, using or sharing connected vehicle data, and must let consumers request, review and delete their data and disable geolocation collection.

California's $12.75 million settlement with GM, announced in May 2026 by Attorney General Rob Bonta and partner district attorneys, and subject to court approval, is the most recent action as of publication. The California DOJ found that state drivers were not directly affected by rate increases. California law prohibits insurers from using driving data to set rates, so the settlement targets the data sale itself rather than premium harm.

Texas Attorney General Ken Paxton filed the January 2025 lawsuit against Allstate and Arity, which his office called the first enforcement action brought by a state attorney general under a state data privacy law, and later opened probes into Ford, Hyundai, Toyota and Fiat Chrysler for similar practices in 2024 and 2025. Arkansas sued OnStar and GM in February 2025; Nebraska filed its own suit in July 2025.

California's privacy regulator, the California Privacy Protection Agency (CPPA), fined Honda $632,500 in March 2025 for requiring excessive personal information from consumers trying to exercise their opt-out rights and for using consent designs that made opting in easy but opting out difficult. The CPPA fined Ford $375,703 in March 2026 for adding unnecessary friction to the opt-out process, including requiring email verification to submit privacy requests.

Virginia Governor Abigail Spanberger signed SB 338 into law on April 13, 2026. The law bans the sale of precise geolocation data; it takes effect July 1, 2026, after this article's publication date. Virginia is the third state to enact such a ban, joining Maryland and Oregon. Oregon updated its privacy law in 2025 to cover motor vehicle manufacturers regardless of consumer volume. The change closed a loophole that had exempted smaller operations. Connecticut's Attorney General reported that 2025 enforcement work in the state included connected vehicles and geolocation data. About 20 state privacy laws covering consumer data are in effect as of 2026.

Section 24220 of the Infrastructure Investment and Jobs Act requires the National Highway Traffic Safety Administration to issue safety standards mandating advanced drunk and impaired driving prevention technology in all new passenger vehicles. The law set a November 2024 deadline for NHTSA to finalize those rules; vehicle compliance would follow two to three years after a final rule. NHTSA missed the deadline and has yet to issue a final rule.

NHTSA says the technology isn't ready. Its February 2026 Report to Congress acknowledged that no in-vehicle technology currently in production can passively measure blood alcohol concentration at or above 0.08 g/dL. The agency is developing two approaches through the DADSS (Driver Alcohol Detection System for Safety) program: breath-based sensors in the steering column and touch-based infrared sensors in the start button or steering wheel. Neither has reached production readiness, and NHTSA has not set a new compliance timeline.

If the technology reaches production vehicles, the impairment-detection mandate could create a new category of data that insurers would seek access to. Passive impairment monitoring would generate biometric or health-related vehicle data, and current federal law doesn't address how that data can be collected, stored, shared or sold. Privacy and consumer advocates have flagged the risk that impairment-detection systems could be repurposed for broader surveillance. Early telematics systems followed the same path: marketed as safety features, then used for insurance pricing.

Drivers can request a free copy of their LexisNexis driving report through the company's consumer disclosure portal at consumer.risk.lexisnexis.com. Under the Fair Credit Reporting Act, LexisNexis must provide this report at no charge. The report shows what driving behavior data has been collected and which companies have requested or received related consumer-report information.

GM discontinued its Smart Driver program in March 2024 and cut its data-sharing partnerships with LexisNexis and Verisk following the FTC investigation and media coverage. Other automakers still collect and share data. Consumer Reports has published a manufacturer-by-manufacturer guide to opting out of data collection; that guide is a useful reference for journalists explaining the process to readers.

Driver rights vary by state. California residents can exercise opt-out rights under the California Consumer Privacy Act. Texas residents have protections under the Texas Data Privacy and Security Act (TDPSA), the law cited in the Allstate and Arity lawsuit. Virginia, Oregon, Maryland and Connecticut all have privacy laws covering vehicle-generated data. The FTC's consent order against GM requires the company to give all U.S. consumers the right to opt out of geolocation and driver behavior data collection, regardless of state.

For journalists covering the telematics beat, the distinction for readers is between two program types: plug-in OBD-II devices, which avoid continuous smartphone tracking but still log driving behavior, and app-based programs, which create a larger data footprint. Insurers that use telematics only for discounts (State Farm, Nationwide and USAA) carry less rate risk for drivers than those that can use the data to raise rates.

Drivers weighing whether a telematics program is worth the privacy tradeoff should know that usage-based programs affect the full policy premium but don't change what's covered. MoneyGeek's guide to car insurance coverage types explains what each coverage pays for and which are required by state law. 

Some insurers allow quote requests without personally identifiable information, which means rate comparisons don't have to come at a privacy cost. MoneyGeek's guide to getting an anonymous car insurance quote covers which insurers allow this and how.