Stop Your Car From Collecting and Sharing Your Driving Data

For years, some car insurers have offered their customers the option of getting a discount on their premiums for agreeing to share their driving data. To collect it, insurance companies would typically have you install a plug-in device on your car dashboard or download a smartphone app that tracked your location and speed. 

By the 2020s, these telematics programs were becoming outdated. Vehicle internet-connected onboard computer systems now allowed automakers to more easily collect even more detailed driver behavior data—precise measurements of how fast you drive or how hard you hit the brakes or the accelerator pedal, among hundreds of other behaviors.

Automakers can use this data to understand how crashes happen and improve car safety features. But for them, collecting it also came to make sense from a business perspective. For example, at a 2023 industry conference in Detroit, a Hyundai executive said that customers who had the company’s Bluelink app were more likely to spend money to get their cars repaired at Hyundai dealerships and stay loyal to the brand. “We have seen that our current connected customers, on average, spend a certain percentage more with our company,” said the executive, Vijay Rao.

Both automakers and car insurance companies, in turn, use the aggregated data to create driver scores, which can be likened to credit scores. They “paint a picture about how risky a consumer is,” says Andrea Amico, who started Privacy4Cars in 2014 to allow people to find out what data has been collected about them by their car company. 

Low driver scores can result in higher costs. The Consumer Federation of America, which researches car insurance telematics programs, says driver scores could, for example, unfairly increase rates for lower-income workers who work night shifts—a phenomenon that often disproportionately affects Black and Latino consumers. Similarly, data about the neighborhood you live in and where you drive can also be used against you. Just a few states—California, North Carolina, and Rhode Island—prohibit the use of most or all driver data to raise drivers’ insurance premiums.

Many drivers know little about the data brokers, or “vehicle data hubs,” that store their driving data. Most data brokers rarely broadcast who they are or what they do.

“The fact that there are so many companies interacting with private data that the car owner has no relationship with is exactly why car companies sharing with third parties is a problem,” says Thorin Klosowski, who researches digital privacy issues for the nonprofit Electronic Frontier Foundation. “Your driving data goes to a half a dozen companies you’ve never even heard of for reasons you’d perhaps never agree to if asked directly.”

LexisNexis Risk Solutions has partnerships with car companies like Kia and Mitsubishi, and has had one with Subaru. But it likely has a much bigger share of the driving data market than what’s publicly known. In a 2023 annual report, LexisNexis Risk Solutions said 86 percent of new U.S. auto insurance policies issued that year benefited from its products. Its revenue has climbed to more than $3 billion in 2023, with just under 40 percent of its business attributed to insurance clients. 

Data brokers are being newly scrutinized, prompted, in part, by investigations by The New York Times, The Markup, and nonprofit groups into what driving data is being quietly collected, with little in the way of warnings or requests to consent to that data being shared. In January, the Texas Attorney General’s office sued Allstate and one of its subsidiaries, Arity, for allegedly collecting, using, and selling driving data of roughly 45 million Americans through embedded software on smartphone apps, which regulators say wasn’t properly disclosed to users. The apps that Allstate contracted with include Life360, billed as a family location safety app, and GasBuddy, which helps users find prices and discounts at gas pumps.

Yet many telematics programs and apps are still shrouded in secrecy even as driving data is bought, shared, and sold at dizzying rates. After the state of Oregon passed a new privacy law that went into effect in July 2024, allowing its residents to request a list of all companies that their personal data is shared with and sold to, nearly 400 Oregon residents asked Privacy4Cars to file such requests with carmakers last year.

Not a single automaker responded to Privacy4Cars with a list of companies, despite multiple requests.

In the future, some automakers could be forced to disclose more info about where your driving data is going. As part of its settlement with the FTC, General Motors is banned from selling driving data to consumer reporting agencies and will soon publish an online, regularly updated list of all other third-party companies it is sharing driver data with. GM, which discontinued Smart Driver before its government settlement was announced, said the new disclosures and other changes should give “customers more transparency and control.”

But GM’s ban and published list might not do much to reduce the sharing and selling of driving data or help drivers’ insurance premiums. Even the Consumer Data Industry Association, an industry trade group that supports data brokers, thinks so. In a letter sent this month to the FTC, the CDIA said, “Driving behavior data will still be used [emphasis theirs] in the marketplace, and it will still impact consumers’ insurance premiums.” The letter continued, “While consumers will know that they gave consent to GM to share data with insurers, they will not know if this data was even considered, if that data had an adverse effect, or even if GM was the source of that data.”