Your Car Has Been Selling Your Driving Data to Insurers

In May 2026, the California Attorney General announced a $12.75 million settlement with General Motors, subject to court approval, to resolve allegations that GM sold driving and location data from hundreds of thousands of California drivers to data brokers Verisk Analytics and LexisNexis. The California DOJ said GM made roughly $20 million nationwide from those sales between 2020 and 2024. As of 2026, many new cars sold in the United States come equipped with telematics systems that record speed, braking, acceleration and location. According to the FTC’s complaint, GM and OnStar collected location data from some drivers as often as every three seconds. Some automakers, data brokers and insurers built a pipeline that turns your daily commute into a product, often through disclosures that regulators say were unclear or misleading.

GM, Allstate and other companies created two main ways for driving data to reach insurers, and many drivers don’t know how either one works. The diagram below shows both pipelines.

GM’s OnStar Smart Driver program shows the first pipeline: automakers sending data directly to brokers. OnStar collected precise geolocation and driving behavior data from millions of vehicles and sold it to LexisNexis and Verisk. The FTC’s January 2026 consent order against GM settled allegations that the company used a misleading enrollment process and failed to clearly disclose its data collection and sales practices. In one widely cited case first reported by The New York Times, a single driver’s LexisNexis consumer disclosure report ran 258 pages and detailed 640 individual trips, including start and end times, distance, speeding events, hard braking and fast acceleration.

The second pipeline runs through mobile apps, and Allstate’s subsidiary Arity is the clearest example. The Texas Attorney General’s January 2025 lawsuit against Allstate and Arity alleged that Arity’s software development kit was embedded in popular apps like Life360, GasBuddy, Fuel Rewards and Routely. According to the lawsuit, Allstate paid app developers millions of dollars to integrate the SDK, and consumers unknowingly downloaded the tracking software whenever they installed those third-party apps. The Texas AG described the suit as the first enforcement action filed by a state attorney general under a comprehensive state data privacy law. It alleged that Arity collected trillions of miles of location data from more than 45 million Americans.

LexisNexis, Verisk and other data brokers receive data from both pipelines, package it into driver behavior scores and sell those scores to insurance companies. LexisNexis Risk Solutions continues to promote its Telematics OnDemand product, which it describes as bringing automakers and insurance carriers together. LexisNexis says its exchange draws data from U.S. automakers, mobile apps and third-party services. Verisk shut down its driver behavior product and said it would no longer sell that data to insurers after the GM controversy.

Modern telematics systems record far more than mileage. The Maryland Insurance Administration’s 2025 survey of 16 insurers with telematics programs found that these systems can track speed and speeding events, hard braking, rapid acceleration, cornering, time of day driven, miles driven, phone use while driving, trip start and end locations, idle time, turn signal use and even the altitude at which you drive.

Maryland insurers reported using different combinations of data points depending on the technology. App-based programs create the largest privacy footprint because they combine trip detection, phone sensors, route data and phone-use signals. Some telematics apps require 24/7 location access on your smartphone, not only when you’re driving. Plug-in devices installed in the vehicle’s OBD-II port usually avoid phone-level permissions such as always-on smartphone location access but still track core driving behaviors.

Privacy concern is widespread. More than 70% of Americans say they’re worried about being tracked, according to Pew Research Center, and connected vehicles have become a focal point of that concern. Drivers also doubt the data itself: in J.D. Power’s 2025 U.S. Auto Insurance Study, only 38% of customers said the driving data collected by their insurer is always accurate. For a plain-language breakdown of how these programs work and what they monitor, see MoneyGeek’s guide to telematics car insurance. Privacy-conscious drivers can also start with an anonymous car insurance quote, which shows which insurers require the least personal data upfront.

Audited policy records and self-reported surveys tell two different stories, and the results are less favorable than insurers’ marketing suggests. Insurers advertise telematics discounts of up to 30% to 40%, but among Maryland telematics policies at renewal, only 31% saw any premium decrease at all. Even the most favorable national survey puts the figure below half. The chart below shows the split.

The most favorable national figures come from TransUnion’s 2022 consumer survey, in which 48% of drivers enrolled in a telematics program saw rates decrease, 30% saw no change, and 18% saw an increase. Even this self-reported number, drawn from drivers describing their own experience rather than verified records, falls short of the near-universal savings that telematics marketing implies.

The Maryland Insurance Administration’s 2025 report draws on actual policy data and tells a different story. Maryland had 303,845 policies enrolled in telematics programs out of 2,296,713 total policies. Among the 263,703 telematics policies that came up for renewal in 2023, only 31% saw premiums go down. About 24% saw their premiums increase, and 45% saw no change at all. The Consumer Federation of America, which analyzed the Maryland report, concluded that the savings from telematics are a mirage for many drivers, or are at least highly exaggerated.

The table below compares the two datasets side by side. The geographic distinction matters: one is a national self-reported survey, the other is a single state’s verified renewal data.

Not all telematics programs work the same way, and the fine print matters more than the marketing. The bullets below summarize which major insurers can raise your premium based on telematics data.

• Can Raise Rates via Telematics: Allstate, GEICO, Liberty Mutual, Progressive, Travelers
• Discount-Only (No Rate Increases): American Family, Farmers, Nationwide, State Farm, USAA

Even programs marketed as discount-only, like Nationwide’s SmartRide or State Farm’s Drive Safe & Save, may reduce or remove the telematics discount at renewal if the data shows risky driving.

Despite the mixed results, telematics adoption remains limited. Only 17% of insurance shoppers buy a usage-based policy, according to J.D. Power’s 2025 study, though participation reaches 26% among new customers. J.D. Power also found that adoption has roughly doubled since 2016 but plateaued in recent years, even as drivers hunt for ways to offset record premium increases. Drivers weighing the tradeoff can compare what they’d pay without a program against the cheapest car insurance companies for their profile.

The FTC, California Attorney General, Texas Attorney General and other regulators increased enforcement against automaker data sales since 2024.

California’s proposed $12.75 million settlement with GM, announced in May 2026 and subject to court approval, is the most recent action. The FTC finalized its own consent order against GM and OnStar in January 2026, imposing a five-year ban on sharing geolocation and driver behavior data with consumer reporting agencies. For the full 20-year life of the order, GM must get affirmative express consent before collecting, using or sharing connected vehicle data. The order also requires GM to let consumers request copies of their data, seek its deletion and disable geolocation collection from their vehicles.

Texas Attorney General Ken Paxton’s January 2025 lawsuit against Allstate and Arity was described by the Texas AG as the first enforcement action filed by a state attorney general under a comprehensive state data privacy law. Texas also opened probes into Ford, Hyundai, Toyota and Fiat Chrysler for their data-sharing practices in 2024 and 2025. Arkansas sued OnStar and GM in February 2025, and Nebraska filed its own suit in July 2025.

California’s privacy regulator, the CPPA, fined Honda $632,500 in March 2025 for requiring excessive personal information from consumers trying to exercise their opt-out rights and for using non-symmetrical consent designs where opting in was easy but opting out was not. The CPPA fined Ford $375,703 in March 2026 for adding unnecessary friction to the opt-out process, including requiring email verification to submit privacy requests.

State legislatures are moving too. Virginia Governor Abigail Spanberger signed SB 338 into law on April 13, 2026, banning the sale of precise geolocation data, scheduled to take effect July 1, 2026. Virginia is the third state, after Maryland and Oregon, to prohibit those sales. Oregon updated its privacy law in 2025 to cover motor vehicle manufacturers regardless of how many consumers they collect data from, which closed a loophole that had exempted smaller operations. Connecticut’s Attorney General said its 2025 privacy enforcement work included connected vehicles and geolocation data. About 20 state comprehensive privacy laws are in effect as of 2026, and more states are expected to consider vehicle-specific data protections this year.

Section 24220 of the Infrastructure Investment and Jobs Act requires the National Highway Traffic Safety Administration to issue safety standards mandating advanced drunk and impaired driving prevention technology in all new passenger vehicles. The law set a deadline of November 2024 for NHTSA to finalize those rules, with vehicle compliance required two to three years after a final rule is issued. NHTSA missed the deadline, and no final rule has been issued.

NHTSA says the technology isn’t ready. Its February 2026 Report to Congress acknowledged that no in-vehicle technology currently in production can passively measure blood alcohol concentration at or above 0.08 g/dL. The two main approaches being developed through the DADSS (Driver Alcohol Detection System for Safety) program are breath-based sensors in the steering column and touch-based infrared sensors in the start button or steering wheel. Neither system has reached production readiness, and no new timeline has been set.

If the technology does reach production vehicles, the impairment-detection mandate could create another layer of data that insurers may seek access to. Passive impairment monitoring would generate new biometric or health-related vehicle data, and current federal law doesn’t specifically address how this data can be collected, stored, shared or sold. Privacy advocates have raised concerns that impairment-detection systems could be repurposed for broader surveillance, much like early telematics systems that were marketed as safety features before their data ended up in insurer pricing models.

You can request a free copy of your LexisNexis driving report through the company’s consumer disclosure portal at consumer.risk.lexisnexis.com. Under the Fair Credit Reporting Act, LexisNexis must provide this report at no charge. The report shows what driving behavior data has been collected about you and which companies have requested or received related consumer-report information, if disclosed.

To stop your car from sharing data, the process varies by manufacturer. GM discontinued its Smart Driver program in March 2024 and terminated its partnerships with LexisNexis and Verisk after the backlash. But other automakers still collect and share data. Consumer Reports published a detailed guide that walks through manufacturer-by-manufacturer opt-out steps.

Your rights also depend on where you live. California residents can exercise opt-out rights under the California Consumer Privacy Act. Texas residents are protected by the TDPSA, under which the Allstate and Arity lawsuit was filed. Virginia, Oregon, Maryland and Connecticut all have privacy laws that cover vehicle-generated data to varying degrees. The FTC’s consent order against GM now requires the company to give all U.S. consumers the ability to opt out of geolocation and driver behavior data collection.

If you’re concerned about data privacy but still want a telematics discount, look for programs that use plug-in OBD-II devices rather than smartphone apps. Plug-in devices may reduce certain types of data collection, such as continuous smartphone tracking, but they still record detailed driving behavior. And stick with insurers that only use telematics for discounts, like State Farm, Nationwide or USAA, rather than those that can also raise your rates. If a program isn’t worth the privacy tradeoff for you, comparing the best car insurance companies on price and service is the better path to a lower rate. It also helps to know the types of car insurance coverage you actually need before you shop.