Everyday Privacy
Connected Car Data and Who Buys It (2026 Guide)
The short version
Most cars sold since about 2015 have a built-in modem, and several automakers used it to sell how you drive - speed, hard braking, late-night trips, seatbelt use, location - to two risk-scoring firms, LexisNexis Risk Solutions and Verisk, which packaged it for auto insurers. The FTC called GM's version of this an "egregious betrayal" and banned the company from sharing such data with consumer reporting agencies for five years. Verisk shut its driver-report product; LexisNexis still runs a telematics exchange. You cannot opt out of the risk file, but you can see it for free, dispute it, and stop the feed at the car.
What "connected car data" actually means
Connected car data is everything your vehicle's built-in cellular connection can report back to the manufacturer: where the car is, how fast it is moving, how hard it brakes and accelerates, what time of day it is driven, whether seatbelts are fastened, plus whatever the companion app and infotainment system observe. It is collected continuously, not just when you press a button.
That last point is the one drivers tend to miss. In its January 2025 complaint against General Motors, the FTC said OnStar grew over time to collect "precise geolocation data - collected every three seconds for some users." A car that phones home every three seconds is not a car with a feature; it is a sensor you sit inside.
Mozilla's Privacy Not Included team reviewed 25 car brands in September 2023 and gave every one of them its warning label - the first time an entire category failed. Their review found that 84% of brands say they can share personal data with service providers, data brokers, and other businesses, and 76% say they can sell it. Only two brands, Renault and Dacia, sold only in Europe, said all drivers could have their data deleted.
Who buys it: the risk scorers behind your insurer
The documented buyers are not advertisers. They are two companies that act as reference bureaus for the insurance industry: LexisNexis Risk Solutions and Verisk. Both take driving data from automakers, normalize it into a "driving behavior" report or score, and license that to insurers to consult when you request a quote or your policy comes up for renewal.
Senators Ron Wyden and Ed Markey put it plainly in a July 26, 2024 letter to the FTC: Verisk "essentially acts as a credit agency for drivers." Automakers shared data with Verisk, which mined it into Driving Behavior Data History Reports and sold those to auto insurers. The same letter notes that GM has publicly confirmed sharing Smart Driver data with Verisk from 2015 to 2024 and with LexisNexis from 2018 to 2024.
Both companies are consumer reporting agencies under the Fair Credit Reporting Act, which is why they sit in our credit and risk broker category rather than alongside the people-search sites. That distinction decides what you can and cannot ask them to do, and we come back to it below.
What the FTC found at GM
The FTC's action against GM and OnStar is the clearest public account of how the pipeline worked. The agency alleged that GM's enrollment process for OnStar and Smart Driver was misleading, that some drivers did not know they had been signed up, and that GM never clearly disclosed that "every instance of hard braking, late night driving, and speeding" would be sold to consumer reporting agencies.
Those agencies, the FTC said, used the data "to compile credit reports on consumers, which were used by insurance companies to deny insurance and set rates." The complaint quotes one driver telling GM customer service: "I pay you, now you're making me pay more to my insurance company."
The proposed order was announced January 16, 2025, the FTC's first action on connected vehicle data. The Commission finalized it on January 14, 2026 by a 2-0 vote, describing the five-year ban on sharing with consumer reporting agencies as "appropriate given GM's egregious betrayal of consumers' trust." For the order's full 20-year life, GM must obtain affirmative express consent before collecting or sharing connected vehicle data, give every US consumer a way to request a copy and deletion, and provide an opt-out from geolocation and driver behavior collection.
It was not just GM, and the data sold for pennies
GM drew the headlines, but Senator Wyden's office asked three automakers what they gave Verisk and what they got for it. Honda and Hyundai answered with numbers. GM declined to say how many cars or how much money was involved; the senators note the New York Times had reported 8 million vehicles.
| Automaker | Vehicles shared with Verisk | Paid by Verisk | Per car | Years |
|---|---|---|---|---|
| Honda | 97,000 | $25,920 | About 26 cents | 2020 to 2024 |
| Hyundai | 1.7 million | $1,043,315.69 | About 61 cents | 2018 to 2024 |
| GM | Declined to confirm (NYT reported 8 million) | Declined to confirm | Not disclosed | 2015 to 2024 (Verisk); 2018 to 2024 (LexisNexis) |
Source: Senators Wyden and Markey, letter to FTC Chair Lina Khan, July 26, 2024, based on the automakers' own responses.
The enrollment mechanics differed. Honda required drivers to join an optional Driver Feedback program, with Verisk's role buried past the first page of the terms. Hyundai, per the letter, automatically enrolled every driver who switched on the car's internet connection into its Driving Score program, which included sharing with Verisk, without telling them. The senators called the sums "a few additional pennies of profit" on cars selling for tens of thousands of dollars.
The states are still suing
The federal order settled the FTC's case, but state attorneys general have kept filing, and a California settlement in May 2026 put a dollar figure on what GM earned. Every action below concerns the same program, and each one reads like a variation on the same complaint: drivers were enrolled without understanding what they agreed to.
| State | Filed or announced | Key allegation or outcome |
|---|---|---|
| Texas | August 13, 2024 | Data from more than 1.5 million Texans sold to at least two companies to generate "Driving Scores" for insurers; drivers told skipping enrollment would deactivate safety features |
| Arkansas | February 26, 2025 | Deceptive Trade Practices Act and unjust enrichment; third parties sold data to insurers who denied coverage or raised rates |
| Nebraska | July 8, 2025 | Speed, seatbelt use, habits, and location sold to brokers for "Driving Scores"; dealership staff incentivized to enroll customers, sometimes without any consent |
| Iowa | February 26, 2026 | Consumer Fraud Act; collection since 2015, data sold on to insurers used to raise rates, deny, or cancel coverage |
| California | May 8, 2026 | $12.75 million settlement; sales from 2020 to 2024 to LexisNexis and Verisk; GM reportedly earned about $20 million nationwide; must stop sales to consumer reporting agencies for five years and request deletion from both firms |
Sources: press releases from the Texas, Arkansas, Nebraska, and Iowa Attorneys General and the Los Angeles County District Attorney's Office. Allegations in pending cases are unproven.
Your phone is the other pipeline
The car is not the only thing scoring your driving. Insurers also buy movement data collected by software hidden inside ordinary phone apps, and the buyer can be the insurer itself. On January 13, 2025, the Texas Attorney General sued Allstate and its analytics subsidiary Arity, alleging they paid app developers to embed tracking software in apps such as Life360.
According to the complaint, Allstate collected "trillions of miles worth of location data from over 45 million consumers nationwide" to build what it called the "world's largest driving behavior database," and insurers used it to justify higher premiums at quote and renewal. It was the first enforcement action under a state comprehensive privacy law. The fix on that side is device permissions, which our guide to who buys your phone's location data walks through app by app.
Where things stand in 2026
The two named buyers went different ways. GM announced on April 24, 2024 that it was discontinuing Smart Driver and unenrolling every customer, and that "any data sharing with these companies ended on March 20, 2024." Verisk told reporters in June 2024 that it "no longer receives this data from these automakers to generate Reports and also no longer provides Reports to insurers."
LexisNexis did not shut anything. Its Telematics OnDemand product page still describes "driving behavior data from U.S. automakers, mobile apps and 3rd party services that participate in our telematics exchange," delivered to insurers "at both the point of quote and renewal." At the time of writing the page displays Kia and Mitsubishi as partners. We cannot see the contracts behind those logos, so treat that as what LexisNexis markets, not proof of what any particular car sends.
The practical reading: if you drove an enrolled GM vehicle before March 2024, or a Honda or Hyundai in the years above, data about you very likely went to at least one of these firms. Whether it is still on file is something only the firms can tell you, which is why the next step is a disclosure request rather than an opt-out form.
Step 1: pull your free LexisNexis file
LexisNexis Risk Solutions is a consumer reporting agency, so the FACT Act entitles you to a free copy of the information it holds on you once in any 12-month period. The consumer disclosure portal at consumer.risk.lexisnexis.com accepts requests online, by a printable mail-in form, or by phone at 1-800-456-6004. Expect to prove identity with details such as your Social Security number and driver's license number.
Ask for the full disclosure so that any driving behavior or insurance data is included, not only public records. When it arrives, read the sources and dates. If anything is wrong - a trip attributed to you, a score built on a car you sold - the FCRA gives you the right to dispute it, and LexisNexis must investigate. Our LexisNexis guide covers the request and dispute path step by step.
Do not confuse this with the LexisNexis suppression opt-out. That is limited to public and elected officials, people facing a substantial risk of physical harm, and identity theft victims, and LexisNexis states it "does not suppress personal information from ... products regulated by the Fair Credit Reporting Act." Insurance risk data is on the FCRA side, so suppression will not touch it.
Step 2: ask Verisk what it kept
Verisk has no self-service portal, so the request is written. Verisk publishes privacy@verisk.com for questions about how it collects, uses, or discloses personal data, and accepts postal requests addressed to its Chief Privacy Officer in Jersey City. Give your full name, current and previous addresses, and date of birth, and say explicitly that you are asking about driving behavior and insurance data held about you.
Be precise about what you want. A request about claims history used in underwriting is a consumer-report question with FCRA rights attached; a request about marketing data is a different process. Keep the email thread, because no public page will ever show you whether anything changed. The Verisk guide has the exact wording and address.
Step 3: turn off the feed at the car
Disclosure requests handle the past. Stopping new data means going to the source, and the controls live in three places: the automaker's account or app, the vehicle's own privacy settings, and any "driver score" or "safe driving" program you may have been enrolled in at the dealership. Check all three; the FTC complaint and the Nebraska suit both describe enrollment happening without the driver realising.
- Driver score programs. Open the manufacturer app and look for anything scoring your driving or promising insurance discounts. Hyundai told the senators drivers could leave its Driving Score program through the website or app; other brands vary. Leave every such program you did not knowingly choose.
- Data sharing and location. GM owners now have order-backed rights to request a copy of their data, ask for deletion, and opt out of geolocation and driver behavior collection. For other brands, the privacy settings in the account and vehicle menus are the place to look, and the privacy policy tells you which affiliates receive data.
- The connection itself. Disabling the car's internet connection is the blunt option. It also disables emergency calling and remote features, so weigh that honestly. It is the one control the senators say GM itself described as the only opt-out for location sharing back in 2021.
Menus differ by brand, model year, and app version, so if the labels do not match, search the privacy policy for "telematics," "driving behavior," and "affiliates." If you find a program you want to leave and the app will not let you, write to the manufacturer's privacy contact, which the policy is required to list.
What this fixes, and what it does not
Done together, the three steps show you what is on file, correct what is wrong, and stop new driving data leaving the car. They do not erase scores an insurer already pulled, and they do not cover the wider risk data - claims history, property records, prior addresses - that insurers also consult. Our credit and risk broker page explains which requests exist there and why a marketing opt-out never touches an FCRA file.
One more limit: telematics data can raise your rate, not only lower it. The senators reported that Verisk confirmed its contracts did not restrict the data to discounts, and that at the time only Louisiana and Montana prohibited using telematics to raise premiums. If an insurer quotes you high, you can ask whether a driving or claims report was used, and the FCRA gives you the right to see it.
Car data is one exposure among several. The same public records that feed insurers also feed people-search sites that publish your address and phone number to anyone. Our opt-out guides cover those site by site, and a free scan shows where to start. If you are in California, the state's DROP platform reaches every registered data broker with one request; see our California DROP guide.
See what else is already public about you
Your car is one pipeline. Run a free exposure scan to see which data brokers likely list your name and address, plus any breaches tied to your email - no account, nothing stored.
Frequently asked questions
Who buys connected car driving data?
The documented buyers are risk-scoring firms that serve insurers. GM has confirmed it shared Smart Driver data with Verisk from 2015 to 2024 and with LexisNexis Risk Solutions from 2018 to 2024. Honda and Hyundai confirmed to Senator Wyden's office that they shared driving data with Verisk. Those firms packaged the data into driver reports and scores that insurers could pull at quote or renewal.
Is my car still sending driving data to insurers in 2026?
It depends on the brand and what you enrolled in. GM says all sharing with LexisNexis and Verisk ended on March 20, 2024, and Verisk says it no longer receives automaker data or provides driver reports to insurers. LexisNexis still markets a telematics exchange fed by participating US automakers, so check your own car's app and privacy settings rather than assuming.
How much were automakers paid for driving data?
Very little per car. In their July 26, 2024 letter to the FTC, Senators Wyden and Markey reported that Verisk paid Honda $25,920 for data from 97,000 cars, about 26 cents each, and paid Hyundai $1,043,315.69 for 1.7 million vehicles, about 61 cents each. GM declined to tell the senators how many cars or how much it was paid.
What did the FTC order GM to do?
The order, proposed January 16, 2025 and finalized January 14, 2026, bans GM and OnStar from disclosing geolocation and driver behavior data to consumer reporting agencies for five years. For the order's full 20 years, GM must get affirmative express consent before collecting or sharing connected vehicle data, let any US consumer request a copy of their data and its deletion, and provide an opt-out from geolocation and driver behavior collection.
How do I see what LexisNexis has on file about my driving?
LexisNexis Risk Solutions is a consumer reporting agency, so under the FACT Act you can request a free copy of your consumer disclosure once in any 12-month period. The consumer portal at consumer.risk.lexisnexis.com takes requests online, by mail, or by phone at 1-800-456-6004. Ask for the full disclosure so any driving behavior data is included, then dispute anything inaccurate.
Can I opt out of LexisNexis entirely?
Not for this data. LexisNexis limits suppression to public and elected officials, people facing a substantial risk of physical harm, and identity theft victims, and it states that suppression does not apply to products regulated by the Fair Credit Reporting Act. Insurance risk products fall on the FCRA side, so the realistic tools are the free disclosure, the dispute right, and stopping the data at the source.
Can insurers raise my rate because of telematics data, not just lower it?
Yes. The Wyden-Markey letter reports that Verisk confirmed its contracts did not restrict driver data to discounts, and that an insurance trade association expert said only Louisiana and Montana prohibited using telematics data to raise premiums at that time. The FTC alleged GM data was used by insurers to deny insurance and set rates.
Does this also cover phone apps that track my driving?
That is a separate pipeline with the same buyers. In January 2025 the Texas Attorney General sued Allstate and its subsidiary Arity, alleging that software embedded in apps such as Life360 collected driving data from more than 45 million consumers and that insurers used it to justify higher premiums. Check app location permissions as well as your car.
Sources: Federal Trade Commission press releases of January 16, 2025 and January 14, 2026 on General Motors and OnStar; Senators Ron Wyden and Edward Markey, letter to FTC Chair Lina Khan, July 26, 2024; General Motors newsroom statement, April 24, 2024; Verisk statement as reported by The Record, June 2024; LexisNexis Risk Solutions Telematics OnDemand product page, consumer disclosure portal, and consumer opt-out page; Texas Attorney General press releases of August 13, 2024 (General Motors) and January 13, 2025 (Allstate and Arity); Arkansas Attorney General press release, February 26, 2025; Nebraska Attorney General press release, July 8, 2025; Iowa Attorney General press release, February 26, 2026; Los Angeles County District Attorney's Office, May 8, 2026; Mozilla Foundation, Privacy Not Included car reviews, September 2023. Allegations in pending lawsuits are unproven.