Connected-car data, data brokers and your premium

Many newer cars transmit location and driving data to their manufacturers, and until 2024 some automakers sold driving-behavior data to data brokers, including LexisNexis Risk Solutions and Verisk, which packaged it into reports that insurers could use to price or deny coverage. After press reporting in March 2024, General Motors stopped sharing with those brokers, and the Federal Trade Commission's order finalized in January 2026 bars GM and OnStar from disclosing such data to consumer reporting agencies for five years. You can request the reports brokers hold on you and dispute errors.

How car data reached insurers

Connected cars contain a cellular modem that sends data back to the automaker for services such as crash notification, navigation and remote unlocking. Some manufacturers also offered "driving coaching" features that scored the owner's driving. The FTC's complaint against GM describes how this worked in GM's case:

• GM began fitting certain 2015 model year vehicles with a newer OnStar module and 4G data service.
• In December 2016, GM amended an agreement with Verisk to create a "Telematics Data Exchange Program", furnishing data from drivers enrolled in OnStar Smart Driver.
• Smart Driver recorded driving events such as hard acceleration, hard braking, speeding over 80 mph and seat belt use, along with the vehicle identification number and a time stamp; data sent to some buyers included precise location.
• Verisk and LexisNexis used the data to compile consumer reports, typically covering six months of driving events.
• Many consumers learned of it only when an insurer sent an adverse action notice saying a policy had been denied, cancelled or priced higher because of information in such a report.

The FTC also alleged that GM collected precise location "every three seconds" from some vehicles and that its dealership enrollment screens bundled Smart Driver with unrelated notifications, so many owners did not know they had signed up.

Timeline

Sources: the FTC's January 2025 announcement and complaint, the FTC's January 2026 final order announcement, Senator Wyden's July 26, 2024 release, and the Texas and Arkansas attorneys general. The state cases are allegations; for their progress and the wider litigation, see driving data privacy lawsuits and the Texas and Arkansas state guides.

What the FTC order requires

Under the final order announced January 14, 2026, GM and OnStar are banned for five years from disclosing consumers' geolocation and driver behavior data to consumer reporting agencies. For the order's 20-year life, they must:

• Get consumers' affirmative express consent before collecting, using or sharing connected vehicle data, with exceptions such as location data for emergency responders.
• Let any U.S. consumer request a copy of their data and ask for it to be deleted.
• Let owners disable collection of precise location data where the vehicle supports it.
• Offer a way to opt out of collection of location and driver behavior data, with limited exceptions.

The FTC called it its first action involving connected vehicle data. The order applies to GM and OnStar only; other automakers are not bound by it.

How this differs from an insurer's telematics program

When you enroll in an insurer's program, such as those in telematics programs from the major insurers compared, you know you are being scored and by whom. The connected-car cases involved data collected by the automaker and passed to brokers whose reports insurers could buy — often without the driver realizing it. Because the brokers acted as consumer reporting agencies, federal credit-reporting rules give you the right to see those reports and dispute errors, the same rights that apply to claims-history reports (see Your CLUE report and motor vehicle record explained).

How to check and protect your data

1. Request your LexisNexis consumer disclosure. LexisNexis Risk Solutions takes requests at consumer.risk.lexisnexis.com, and says the FACT Act entitles you to one free copy of applicable reports every 12 months. If an insurer sent you an adverse action letter, LexisNexis says to call its Consumer Center at 800-456-6004.
2. Contact Verisk's consumer inquiry center through fcra.verisk.com, which lists a driving data section, or at 800-709-8842.
3. Dispute anything inaccurate with the agency that issued the report, in writing, and keep copies.
4. Read any adverse action notice carefully. It must tell you which reporting agency supplied the information and how to get a free copy.
5. Review your car's connected services. In the automaker's app or the car's settings, look for driving-score, "driver feedback" or data-sharing features and for location-sharing controls, and turn off what you do not use. Ask the dealer what you are enrolling in before you accept connected-service terms at purchase.
6. Check your phone, too. Driving data can also come from apps, as the Texas case against Allstate and Arity alleges; see what driving apps collect and how insurers use it.

For how insurers use driving data you choose to share, see usage-based car insurance explained.

Key takeaways

• Some automakers sold driving-behavior data to LexisNexis and Verisk, whose reports insurers could use in pricing and underwriting.
• GM ended that sharing in March 2024 and dropped OnStar Smart Driver; the FTC's final order of January 14, 2026 bans GM and OnStar from giving such data to consumer reporting agencies for five years.
• Texas sued GM (August 2024) and Allstate and Arity (January 2025); Arkansas sued GM (February 2025); the claims are allegations.
• You can request your LexisNexis and Verisk files and dispute errors under federal credit-reporting law.
• Review connected-service and app settings on your car and phone, and ask what you are agreeing to at the dealership.