1. Two very different kinds of tracking

Telematics simply means collecting data about how a vehicle is driven. That can happen in two ways, and the difference between them is the whole story.

TRANSPARENT Usage-based insurance explained. Programs like Progressive Snapshot, State Farm Drive Safe & Save and GEICO DriveEasy are a trade you make with your insurer on purpose: you let it watch how you drive, and in return you may earn a discount. You install the app or plug in the device, you can usually see your own results, and the purpose — pricing your policy — is the headline, not the fine print.

Does telematics raise insurance rates? It can. Voluntary programs are often marketed on discounts, but results vary. Maryland’s insurance regulator reported that in 2023 renewals, about 30% of participants paid less, 45% saw no change and nearly a quarter saw increases. Opting in is a real trade-off, not a guaranteed saving.

HIDDEN Connected-car data sharing. Many newer vehicles carry a built-in cellular connection. GM’s OnStar system, standard in most 2015-and-newer GM vehicles according to the Texas Attorney General’s complaint, can call for help after a crash and offer navigation. According to the FTC, GM also collected detailed driving behavior through an OnStar feature called Smart Driver and shared it with third parties, including consumer reporting agencies used by insurers, without clearly telling people or getting their informed consent.

The word “consent” matters here, so let’s be exact. The FTC didn’t say nobody clicked anything. It alleged that GM used a misleading enrollment process — so some owners technically enrolled, often during the rush of a dealership sale, without understanding that their driving would be scored and sold. That’s why this guide says you “probably never knowingly agreed,” rather than “never opted in.”

2. The GM settlement, precisely

What California announced

On May 8, 2026, California Attorney General Rob Bonta, the California Privacy Protection Agency (now branded CalPrivacy) and the district attorneys of San Francisco, Los Angeles, Napa and Sonoma counties announced a settlement with General Motors. It is the largest penalty to date under the California Consumer Privacy Act (CCPA) and is subject to court approval.

According to the complaint filed that day, GM sold the names, contact information, geolocation data and driving-behavior data of hundreds of thousands of Californians to Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024. The Attorney General’s office says GM made roughly $20 million nationwide from those sales, and that both brokers bought the data to build driver-rating products for auto insurers. GM resolved the allegations by settlement; it was not a trial verdict.

What GM agreed to

• Pay $12.75 million in civil penalties.
• Stop selling driving data to consumer reporting agencies, including LexisNexis and Verisk, for five years.
• Delete retained driving data within 180 days unless a customer gives affirmative, express consent (with limited internal exceptions).
• Ask LexisNexis and Verisk to delete the driving data they received.
• Run a privacy program for OnStar data and report its assessments to regulators.

The number worth noticing

The penalty ($12.75 million) is smaller than the revenue the state says GM earned from the sales nationwide (about $20 million). That comparison isn’t apples to apples — the penalty covers California only, while the $20 million is a national figure — but it’s a useful reminder that one state’s fine doesn’t erase the business case everywhere else.

The federal order came first

On January 14, 2026, the Federal Trade Commission finalized its order against GM and OnStar, a year after first announcing the complaint in January 2025. The order runs 20 years. It bars GM from sharing geolocation and driving-behavior data with consumer reporting agencies for five years, requires affirmative express consent before collecting or sharing connected-vehicle data (with limited safety exceptions), and requires GM to let consumers request copies of their data, request deletion, disable precise location collection where the vehicle allows, and opt out of geolocation and driving-behavior collection. When the complaint was announced, then-FTC Chair Lina Khan said GM tracked some drivers as often as every three seconds.

GM wasn’t alone in the pipeline

In 2024, Verisk told the privacy group Privacy4Cars that it had received driving data from vehicles made by GM, Honda and Hyundai, and that it no longer receives such data from automakers or provides those reports to insurers. That’s Verisk’s own statement, not an allegation against the automakers.

Separately, American Honda Motor Co. settled with the California Privacy Protection Agency in March 2025 for $632,500. Be precise about what that case covered: it arose from the agency’s review of connected-vehicle makers, but the allegations concerned how Honda handled consumers’ privacy requests — for example, demanding unnecessary identity verification — not the sale of driving data. It shows regulators scrutinizing the whole industry; it is not a second “sold your driving data” case.

3. How the pipeline worked

Here is the chain regulators and plaintiffs describe, step by step. Each link is sourced to the enforcement actions or to the brokers’ own statements.

1. The car records. According to the complaints, the vehicle logged trip start and end times, distance, speed, hard braking, rapid acceleration and seatbelt status, plus location.
2. The automaker collects and sells. GM gathered that data through OnStar and, according to California, sold it to LexisNexis and Verisk from 2020 to 2024.
3. The broker scores you. The brokers turned trip data into driving-behavior reports and scores. Because they act as consumer reporting agencies, federal law (the Fair Credit Reporting Act) gives you the right to see what they hold on you.
4. The insurer pulls the report. When you shop for or renew a policy, an insurer can request your report. The FTC alleged this data was used in ways consumers didn’t expect, including premium increases and coverage denials.

One real example made this public. In a 2024 New York Times investigation, a Chevy Bolt owner requested his LexisNexis file and received a 258-page report, more than 130 pages of which listed every trip he and his wife had taken over six months, with speeding, hard-braking and acceleration events noted and GM listed as the source.

GM says it discontinued Smart Driver by April 2024 and ended data sharing with two outside companies in March 2024. So the active flow at the center of these cases has stopped. What hasn’t necessarily stopped: copies already sitting in broker files, and similar programs at other companies.

4. What’s still being fought in court

Everything in this section is an allegation in active litigation. None of it is a finding of wrongdoing, and no court has found GM or the brokers liable.

• Texas sued GM and OnStar in August 2024 under its deceptive trade practices law, alleging data from more than 14 million vehicles and more than 1.8 million Texans was collected and sold.
• Arkansas sued in February 2025, alleging GM collected data from over 100,000 Arkansans and that it gathered location data even from drivers who activated the car’s internet connection without enrolling in OnStar services.
• Nebraska sued in July 2025, alleging GM buried the data sale inside pages of misleading disclosures.
• Private class actions were consolidated in federal court in Atlanta as In re: Consumer Vehicle Driving Data Tracking Litigation (MDL No. 3115), against GM, OnStar, LexisNexis and Verisk. On April 22, 2026, Judge Thomas Thrash dismissed some claims and allowed others — including federal wiretap and privacy claims — to move forward. That ruling means the claims can proceed, not that they’ve been proven.

Some news reports also mention suits by other states, including Iowa and Indiana. We could not confirm those filings from primary sources, so we don’t rely on them here. Case status can change quickly; check the date at the bottom of this page.

5. What lawmakers are doing in 2026

States banning car data sharing with insurers in 2026: the honest status

Missouri. You may have seen “Missouri HB 1121” described as a new law. It isn’t. HB 1121 was a 2025 bill that would have barred insurers from buying driving data from third parties such as automakers; it stalled. Its 2026 successor, HB 2324 from Rep. Bill Lucas, would require the vehicle owner’s express written consent before an insurer buys driving data. It got a committee hearing on April 13, 2026, where insurance-industry witnesses argued it could undercut voluntary discount programs. Reporting at the time said it wasn’t scheduled for a vote, and we found no record of it becoming law.

Maryland. SB 984, introduced in 2025, would have limited how insurers use telematics and required an appeals process for bad data. It did not pass. We found no 2026 replacement enacted.

California, a bill that went the other way. AB 311, the “Consumer Driving Data Protection Act of 2026,” would have let California insurers use telematics for drivers who opt in, with written consent and use limits. It passed the Assembly but, according to Capitol Weekly, was held under submission by the Senate Appropriations Committee in August 2026, meaning it stalled. For now, California remains the only state where insurers can’t price on driving data.

Congress. The Auto Data Privacy and Autonomy Act has been reintroduced as H.R. 6734 (Rep. Eric Burlison, R-Mo., introduced December 16, 2025) and S. 3494 (Sen. Mike Lee, R-Utah). It would bar automakers from accessing or selling most vehicle data without the owner’s written consent and give owners free access and deletion rights. As of our check it had been referred to committee and had not advanced.

6. Buying a used connected car? Check this

A connected car’s services are tied to an account, and accounts don’t always follow the title. Privacy advocates have long warned that a previous owner’s app access, settings or data-sharing choices can survive a sale unless someone resets them. Practices vary by manufacturer, so we can’t tell you exactly what happens with your car. Do these things regardless:

• Contact the manufacturer’s connected-services line to confirm the previous owner’s account is removed and yours is set up with your own choices.
• Review every privacy and data-sharing setting in the car and in the brand app; don’t assume they start at “off.”
• Reset the infotainment system to clear paired phones, saved addresses and linked accounts.
• When you sell, do the same in reverse: cancel connected services, remove the car from your app, and factory-reset the head unit.

7. Where this could go next (not confirmed)

• Pricing bias by place and pattern — a concern raised by consumer advocates, not a confirmed practice. In an August 2026 letter opposing California’s AB 311, the Consumer Federation of America warned that telematics programs without strong oversight risk unfair pricing and racial bias. Critics worry that where and when you drive or park could stand in for protected traits. That is a warning about poorly regulated programs, not evidence that it is happening today.
• Handing pricing to outside vendors — a concern raised by regulators, not a confirmed practice. California’s Department of Insurance has argued that AB 311 would shift oversight to lightly regulated telematics vendors. The worry is opacity, not a documented abuse.
• Security of broker databases — a plausible future concern, not a confirmed breach. Any large store of location and trip history is a target. A Mozilla Foundation study of car brands’ privacy practices, cited by Rep. Burlison when he introduced the federal bill, found most brands give drivers little control over their data. We found no confirmed breach of driving-score data from these specific pipelines.
• Warranty claims and health insurance — speculation only. You may see claims online that driving data is being used to deny warranty repairs or set health premiums. We found no documented case, enforcement action or credible report of either. Treat these as unverified until someone shows evidence.

8. How to check and opt out

There’s no single universal opt-out across all car brands. These steps cover the three places your driving data can live: the car, the automaker and the brokers.

1. Request your broker files first. Because these brokers act as consumer reporting agencies, you’re entitled to see what they hold. Request your free consumer disclosure report from LexisNexis Risk Solutions. For Verisk, use its driving-behavior disclosure request form; Verisk says it only ever received driving data from GM, Honda and Hyundai vehicles. If something is wrong, you can dispute it.
2. Check the car’s own settings. Look in the infotainment menu for “privacy,” “connected services,” “location services” or “data sharing.” Turn off anything you don’t want. Some cars let you disable location while keeping crash response.
3. Check the brand app. In the manufacturer’s app (for GM, the Chevrolet, Buick, GMC, Cadillac or OnStar apps), look for driving-behavior, “smart driver” or insurance-sharing features and turn them off.
4. File a request with the automaker. Search “[your brand] privacy request” to find its data-request portal. Ask for a copy of your data, deletion, and an opt-out of sale or sharing. Residents of California and other states with privacy laws have statutory rights here; the FTC order gives all U.S. GM customers access, deletion and opt-out options.
5. Ask your insurer directly. If your rate rose, ask in writing what data sources were used. If an insurer takes adverse action based on a consumer report, federal law generally requires it to tell you and name the agency that supplied the report.

9. What this isn’t

Most rate changes have ordinary causes — claims, tickets, repair costs, where you live — and connected-car data is one newer, narrower source behind some of them. For the full picture of how premiums are built, read How Car Insurance Rates Are Calculated (and Why Yours Rose).

10. FAQ