Connected cars are selling driver behavior data to insurers, and most drivers don't know it
Most drivers assume their insurance rate is set by their driving record, their zip code, and their claims history. Increasingly, it's also being shaped by data their own car collected and sold — hard braking events, speed over limits, late-night trips, phone use while driving — funneled through a pipeline most drivers never agreed to and can't see into. Enforcement is finally catching up to this practice, but unevenly, and most of the protection depends on which state you live in and which automaker you drive.
Two pipelines, one destination
Driving behavior data reaches insurers through two main routes. The first runs from the automaker's built-in telematics system — the same connectivity that powers remote start, roadside assistance, and OnStar-style services — to data brokers who aggregate and resell it. The second runs through third-party smartphone apps, often bundled with roadside assistance or rewards programs, that track driving behavior directly from a phone's sensors.
Both pipelines tend to converge on the same handful of data brokers. LexisNexis Risk Solutions and Verisk are the two major players that receive raw driving data and convert it into standardized "driver behavior scores" that insurers buy and plug directly into underwriting models. Reporting suggests Verisk has stopped accepting connected-vehicle data directly from automakers, narrowing that particular pipeline, while LexisNexis continues to market telematics-derived products to the insurance industry. The practical effect is that a driver can decline a visible "usage-based insurance" app and still have behavior data reach an insurer through the car's own built-in connectivity — a channel with far less visibility and, until recently, far less regulatory attention.
Enforcement has started, but it's narrow and recent
The most significant action to date is the FTC's consent order against GM and OnStar, finalized in January 2026. Under its terms, GM must now obtain affirmative express consent before collecting, using, or sharing connected-vehicle data, and consumers can request deletion of collected data or disable geolocation collection outright. That's a meaningful change — but it's specific to GM, reached through a federal consent order rather than a general rule, and doesn't bind other automakers.
State-level enforcement is newer and more fragmented. Texas sued Allstate and its telematics subsidiary Arity over data collection practices — reportedly the first enforcement action brought by a state attorney general under a state consumer-privacy law specifically targeting telematics. A separate Texas action reportedly targets Progressive and Toyota over allegations of sharing driving data without explicit consent, though those are allegations rather than established findings at this stage. California has gone the financial-penalty route instead, reportedly fining GM $12.75 million, Honda $632,500, and Ford $375,703 for connected-car data practices as of mid-2026.
New state laws are starting to close gaps that existing privacy law didn't cover. Utah's HB 357, effective May 6, 2026, adds specific motor-vehicle data protections. California's SB 1210, taking effect in July 2026, will require opt-in consent before automakers can share geolocation data with insurers specifically — a narrower and more targeted rule than general data-privacy statutes, aimed directly at the insurer pipeline. Several other states have introduced similar telematics-privacy bills, though most have stalled in committee rather than reaching a vote.
The transparency gap that remains
Even where consent rules exist, insurers generally aren't required to disclose which specific data sources informed a given rate decision. A driver denied a discount, or hit with a higher premium at renewal, typically has no straightforward way to learn whether a telematics score contributed, let alone to see or contest the underlying data. That asymmetry — your data feeding a decision you can't inspect — is the core problem regulators have been slower to address than the collection question itself.
What drivers can actually do right now
Check your automaker's connected-services or privacy portal directly, not just the glovebox manual — most major automakers now have a dedicated privacy dashboard where you can review and disable specific data-sharing categories, including geolocation and driving-behavior tracking. If you're a GM or OnStar customer, you're specifically covered by the FTC consent order: you have a documented right to request data deletion and disable geolocation collection, and GM is required to honor that request.
Don't assume the absence of a visible telematics app means no data sharing is happening. Built-in automaker connectivity can feed the same broker pipeline without any app installed or discount offered — the data collection and the discount offer are separate decisions, and declining one doesn't necessarily opt you out of the other. Check the connected-services settings specifically, not just whether you've signed up for a usage-based insurance program.
If you live in Utah or California, the new state-specific protections (HB 357 and SB 1210, respectively) give you stronger, more explicit rights than drivers in most other states currently have — it's worth knowing your state's specific statute rather than assuming a federal baseline covers you. For everyone else, the regulatory patchwork means your actual protection depends heavily on your zip code, not just your driving record, at least until more states follow Utah and California's lead.