Security and privacy risks of OBD dongles and driving apps

The two kinds of tracking carry different risks. A plug-in OBD dongle is a small computer wired into your car's internal network, so the worry is what an attacker could do through it. A phone app asks for your location and motion data, so the worry is who keeps that data, for how long, and who else gets it. Neither risk is a reason to refuse every program, but both are reasons to know what you are agreeing to and to choose the least-exposed option that gets you the discount.

This article separates what researchers have actually demonstrated from what is only possible, shows what insurers' own documents say they collect and keep, and gives a checklist for limiting your exposure.

What an OBD-II port exposes

Every modern car has a standard diagnostic socket, usually under the dashboard on the driver's side. Mechanics plug scan tools into it to read fault codes. A dongle is a consumer-sized scan tool that stays plugged in.

A 2015 paper from the University of California, San Diego, Fast and Vulnerable: A Story of Telematic Failures, explains why the port matters. Standard protocols let a connected device read an array of low-level sensor information about the car's operation. In addition, the port commonly gives access to the vehicle's internal networks, typically one or more "CAN buses." The authors note that most aftermarket devices are designed for monitoring only, but CAN is a multi-master bus, so any device with a CAN transceiver can send messages as well as receive them. Transmit access to the CAN bus, they wrote, "is frequently sufficient to obtain arbitrary control over all key vehicular systems (including throttle and brakes)."

The same paper describes what these dongles carry inside: a processor, a GPS chip, an accelerometer, a gyroscope and, commonly, a cellular modem for remote data connectivity. They typically draw power from the port. So a dongle is not a passive sensor. It is a networked computer with GPS and a wired connection to your car's electronics. Whether that is safe depends on how well it is built and maintained.

What researchers have demonstrated

Two public studies from early 2015 are the best-documented examples. Both date from a decade ago and concern specific devices, so treat them as evidence of what can go wrong, not as a description of every device today.

The Progressive Snapshot study. In January 2015, Corey Thuen of Digital Bond Labs reverse engineered a Snapshot plug-in device and found that it did not authenticate itself or encrypt its traffic data, and had no digital validation signatures or secure boot function, according to Kaspersky's account dated January 27, 2015. Kaspersky reported that Thuen's work "stopped short of injecting code into the car's network." In other words, the research showed missing protections, not a completed attack on a vehicle. I did not find a statement from Progressive in the pages I read.

The UCSD study. The researchers examined a popular aftermarket telematics unit supplied for insurance use. Their findings, in the August 2015 paper, included that the devices could be found and targeted by a remote attacker. Specifically:

• Web, telnet and SSH services were reachable over the cellular connection, and several thousand devices were found through search engines and scanning services.
• Firmware updates were not cryptographically signed, so a rogue update could be installed.
• The device accepted commands by text message, and a whitelist of allowed numbers could be bypassed because phone numbers can be spoofed.
• Devices from the manufacturer shared the same SSH key, and the passwords were weakly hashed; the researchers cracked the user password in under 10 seconds.
• Once compromised, a device could send arbitrary CAN messages, and the team demonstrated selectively applying and disabling brakes with a volunteer driver at low speed.

The disclosure section is as instructive as the findings. The authors told the device maker, the insurer that was a customer of that platform, and the ride-hailing company that was in turn a customer of the insurer. All were supportive, and the insurer planned to disable SMS access on its devices. But the authors added that while the manufacturer said many problems had been fixed in later software, they did not find those updates on recent production devices they tested. A fix that exists but never reaches deployed hardware is a persistent theme in this space.

Two caveats to keep the risk in proportion. First, neither source reports an attack on a real driver; these were research demonstrations. Second, I found no recent independent test of the dongles insurers distribute today, so I cannot say whether the same weaknesses persist.

The risk is smaller if you avoid the device, but not zero

Insurers have shifted toward phone apps, and Progressive's Snapshot page says its plug-in device is used if the mobile app is not available in your state. When you have a choice, an app avoids putting new hardware on the car's network. It does not avoid data risk, which is the next part.

If you do use a device:

• Take it only from the insurer, not a third party.
• Unplug it and return it when the program ends. Progressive's FAQ says device users return the device when they opt out or when the program ends.
• Do not leave a retired dongle in the port.
• Keep an eye out for firmware updates or recalls the insurer sends.
• Mention it to the shop at service visits so a technician can see it is installed.

What a driving app collects

Insurers disclose more than most drivers read. Here is what their own documents said as of November 2026.

• Progressive. Snapshot's privacy statement says the app collects driving data (speed, GPS location, phone sensor data), mobile phone information and app analytics, and "does not record the content of your communications." Partner technologies inside the app collect device details such as operating system, model and carrier, and device and advertising identifiers. The device collects speed, time of day and the VIN and may record G-force and GPS location.
• GEICO. DriveEasy's help center says the app collects driving-related data from GPS, Bluetooth and other sensors only when a trip is taking place, and does not access messages, calls or contacts.
• State Farm. The Drive Safe & Save FAQ says its beacon has no GPS and cannot track vehicle location, while the app records trips when the beacon stays connected to the phone and both move at driving speed.
• Across insurers. The Maryland Insurance Administration's 2025 telematics survey asked 16 insurers what they collect. The list the agency compiled includes location, speed, braking, time of day, cornering, trip route, odometer, mobile phone usage, phone permissions, device information, screen activation data, phone motion, and for connected cars items such as seat belt and lane-keeping data. The agency called it a general outlook, not a complete list.

Notice what that last list implies. Rating on "how you drive" is only part of what is gathered. A route history shows where you live, work, worship and see doctors, even when the insurer says the route is not used to set price. Progressive's app terms, for instance, say "where you drive is not used in determining your personalized rate" but that location may be used for underwriting, accident detection, claims and research.

Permissions: what you grant and what it means

Phones ask in layers, and the layer an insurance app needs is the broadest one.

On Android, the developer documentation describes foreground and background location separately. Foreground access covers an app you are using or that runs a visible service. Background access is for features that constantly use location, and since Android 10 the app must request it separately; the system then sends a reminder notification that the app can access location all the time. The documentation also distinguishes precise location, usually within about 50 meters, from approximate location, within about 3 square kilometers. It notes that Google Play restricts background location to apps that need it for core features.

On iPhone, Apple's Location Services page describes the equivalents: allow once, while using the app, and background use, with periodic reminders after you grant background access. It lists Motion & Fitness as a separate data type managed under Privacy & Security.

For a trip-detection app, "only while using" will usually defeat the purpose, because it must start recording when you get in the car. That is a legitimate need, but it means the app has standing access. So grant what the program requires and nothing more, check each permission after installing, and review the list again when the program ends.

Who else may see the data

Outsourced collection. The Maryland survey found that 11 of 16 insurers had a third party collect telematics data, with 5 collecting it directly. The agency said many insurers described strong processes for checking those vendors, and that most vendors are bound by contract. The Consumer Federation of America, in an August 2025 analysis, said it is "skeptical" of the security and privacy claims. The survey also found that many insurers retain the data for 5 to 25 years and a few indefinitely. Progressive's statement says device data is retained indefinitely.

Sharing for other purposes. Progressive's privacy statement says personally identifiable data may be shared with service providers who must keep it confidential, with a state department of insurance "to support renewal rates," and, in de-personalized form, more broadly. Its app terms add that information may be given to opposing parties, police or in response to a subpoena. GEICO's DriveEasy page says it never sells or shares driving data with third parties. State Farm's page says it does not sell customer information and shares it with third parties only in limited situations.

Data that does not come from the insurer's app. Some of the most serious cases involve driving data gathered outside a policy. In January 2025 the Texas attorney general sued Allstate and its Arity subsidiary, alleging they collected location and movement data from Texans through software embedded in third-party mobile apps and used it to raise rates. The article I read carried no response from Allstate or Arity. That is an allegation in a lawsuit, and I did not confirm how the case ended, so check the court record for the outcome. On the car side, the Federal Trade Commission's January 14, 2026 final order against General Motors bars it for five years from disclosing geolocation and driver behavior data to consumer reporting agencies and requires affirmative express consent for the 20-year term. In 2024, Insurance Journal reported that senators told the FTC that GM, Hyundai and Honda had disclosed driver data to Verisk, which prepared reports for insurers; the companies said disclosure to insurers required consumer consent. These cases involve car makers and app developers, not the insurer's own app, but they show where else driving data can travel. More is in connected-car data, data brokers and your premium and driving data privacy lawsuits.

When a breach happens

Breach-notification laws exist everywhere. The National Conference of State Legislatures says all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses to notify individuals of breaches involving personal information (NCSL summary). These laws vary in who must comply, what counts as personal information, what counts as a breach, notice timing and exemptions such as for encrypted data. The NCSL describes typical covered information as a name combined with a Social Security number, driver's license or state ID, or account numbers. Whether trip history or location records count as personal information depends on the state's definition, and I cannot state that for each state. Do not assume location trails trigger a notice.

Insurers face a second layer. The National Association of Insurance Commissioners' Insurance Data Security Model Law (#668) calls on licensees to maintain an information security program, investigate cybersecurity events and notify the state insurance commissioner of them, and, as of the NAIC's cybersecurity page at the time I read it, 21 states had adopted it. Because states adopt models independently, protection differs by where you live. The Who protects your insurance data: GLBA, state acts and your rights article explains how federal and state privacy rules reach insurers.

One more gap from the Maryland report: its conclusion says privacy notices vary from insurer to insurer and "there are currently no requirements regarding how the notice must be written."

How to limit your risk

1. Prefer the app to a plug-in device when both are offered, unless you decide the phone data is the greater exposure. See plug-in device, phone app or built-in car data: which tracking method?.
2. Check the permissions after installing and on your phone's privacy dashboard, and turn off anything the program does not need.
3. Use a strong, unique password and two-factor sign-in for the insurer account, since it can show your trips.
4. Install on the phones that need it. Avoid installing on a phone you do not control.
5. Treat the end of the program as a date to act on. Uninstall the app, return the device, and ask the insurer in writing what it retains and whether it will delete the data. Progressive's statement does not describe a general right to request deletion, and State Farm's FAQ says uninstalling stops complete data collection but describes no deletion process, so expect that you may not be able to erase history. See leaving a telematics program: what happens to your data and discount.
6. Watch for the insurer's notices, and complain to your state department of insurance if you believe your data was mishandled. The how to file a complaint against a car insurance company guide explains how.

How to read a privacy policy for a driving program

Read the program's own statement, not the corporate homepage policy. A quick pass with the right questions beats reading every word.

Compare programs by running the same table across two or three of them. The what driving apps collect and how insurers use it guide lists what each major program says.

Common questions

Is a phone app safer than a plug-in device?

They fail in different ways. A dongle's worst case, shown in research on 2015 devices, is that an attacker reaches the car's internal network. An app's worst case is a large, detailed record of your movements held by the insurer and its vendors. For most drivers the second is the likelier exposure, which is why permissions and retention matter more than hardware.

Can my insurer sell my driving data?

The pages I read from GEICO and State Farm say they do not sell it, and Progressive's statement lists specific sharing and uses. The statements are promises in each company's own words. Read the current version before enrolling, since policies change.

What can I do if my trip data was exposed in a breach?

Notification rules depend on your state and on whether the data counts as personal information there. Contact the insurer, ask what was exposed, and consider a complaint with your state department of insurance. For specifics on your rights, a licensed attorney or the department is the place to ask.

Does a built-in connected-car system carry the same risks?

Similar, with a different channel. The car maker, not the insurer, holds the data, and consent is the main safeguard. The FTC's GM order shows regulators treat that consent seriously.

Key takeaways

• A plug-in OBD device is a networked computer with a wired link to the car's internal bus; 2015 research on two devices found serious flaws, but neither study reported an attack on a real driver.
• An app collects location and motion data under standing permissions, and insurers keep it for years in some cases; retention and sharing terms matter more than the sensor.
• Insurers' own statements differ on sale, sharing and deletion, and Maryland's regulator noted there are no requirements on how privacy notices are written.
• Breach-notification laws exist in every state, but whether location records are covered varies, and the NAIC's data security model law had been adopted by 21 states.
• Grant minimum permissions, secure the account, and end the program deliberately by uninstalling, returning devices and asking in writing about deletion.