The story broke through reporting by Kashmir Hill in the New York Times, and the mechanics turned out to be less exotic than the surprise suggested. Connected vehicles have carried cellular modems for years. Those modems already transmit diagnostics, crash notifications, and location. Adding driver behaviour to the stream costs the manufacturer nothing and produces something with an established buyer.
What made it consequential was the destination. The behaviour data did not go to the manufacturer's own analytics team and stop there. It went to consumer reporting agencies, which is a specific legal category, and from there into the underwriting process for auto insurance.
The pipeline, one hop at a time
Four parties are involved, and the transitions between them are where the consent question gets murky.
| Stage | What moves | What the driver typically saw |
|---|---|---|
| Vehicle to manufacturer | Trip start and end, distance, speed, hard braking, rapid acceleration, sometimes location | A safety score or driving insights feature in the companion app |
| Manufacturer to data partner | Per-trip event records tied to a vehicle identification number and a person | A clause in a privacy policy or a checkbox during vehicle or app setup |
| Data partner to reporting agency | The same records, compiled into a consumer report format | Nothing |
| Reporting agency to insurer | A report, purchased at quote or renewal time | A premium that went up, with no stated reason tied to this |
By the last stage the driver has no visibility at all. An insurance quote arrives as a number. Nothing in it says which data sources fed the model, and nothing requires the driver to be told that a report on their braking habits was consulted.
What regulators did
The response arrived in three distinct forms, which is worth noting because each has a different reach.
The manufacturer stopped. General Motors announced in March 2024 that it would end the sharing of driver behaviour data with LexisNexis Risk Solutions and Verisk, and later said it was discontinuing the smart driver program that generated it. Verisk closed the telematics exchange that handled this category of data.
A state attorney general sued. Texas filed suit against General Motors in August 2024 over the collection and sale of driver data, alleging the consent obtained during vehicle purchase and app enrolment was inadequate.
The FTC acted on the reporting-agency link. In January 2025 the Commission announced a proposed order that would bar GM and OnStar from sharing geolocation and driver behaviour data with consumer reporting agencies for five years, and would require affirmative consent before collecting that data going forward.
When behaviour data is compiled into something a company sells to help others make decisions about your eligibility for insurance or credit, US law treats it as a consumer report. That designation carries obligations: you can request your file, you can dispute inaccuracies, and the buyer must tell you when the report contributed to an adverse decision. The Fair Credit Reporting Act was written in 1970. It applies here because of what the data is used for, not because anyone anticipated connected cars.
The accuracy problem underneath
Set aside consent for a moment. There is a separate question about whether these signals mean what the scoring model treats them as meaning.
A hard braking event is an accelerometer reading past a threshold. It does not distinguish between inattention and a correct emergency response to somebody else's error. A driver who brakes hard because a child stepped into the road produces the same record as one who was following too closely. Late-night trips score worse in some models regardless of who was driving or why, which is a proxy that falls unevenly on shift workers and caregivers.
Then there is attribution. The record is tied to a vehicle. Households share cars. A teenager, a partner, or a valet generates events that land in the registered owner's file with nothing marking the difference.
A model that scores a correct emergency stop the same way it scores tailgating is not measuring safe driving. It is measuring how often the accelerometer crossed a line, and then pricing that as though the two were the same thing.
How to see what exists about you
The rights that apply here are ordinary consumer reporting rights, and they work regardless of whether you drive a connected car.
- Request your consumer disclosure from the specialty agencies. LexisNexis Risk Solutions and Verisk both operate consumer disclosure processes, separate from the credit bureaus. US residents are entitled to a free copy on request. The file is what a prospective insurer would see.
- Check the claims history file as well. The same agencies maintain claims databases that predate any of this and feed the same underwriting decisions.
- Dispute anything wrong. The Fair Credit Reporting Act obliges the agency to investigate and correct inaccurate entries, and this applies to telematics-derived entries the same as to any other.
- Ask your insurer directly which data sources they use at quote and renewal. Some will answer plainly. An adverse action notice, which you are entitled to when a report contributed to a worse outcome, names the agency that supplied it.
- Turn off connected services in the vehicle and the app. Manufacturers vary in how much they let you disable, and in some vehicles the modem stays active for emergency and diagnostic functions even when data sharing is off.
- Use state privacy rights where you have them. Deletion and opt-out rights under California and similar state laws apply to this category, though the interaction with consumer reporting law is imperfect. Our comparison of CCPA and GDPR rights covers what each actually compels.
The part that generalises
Telematics is one instance of a pattern documented across several industries: a device collects operational data for a stated purpose, an internal team finds a secondary market for it, and the data reaches a decision about the person that they were never told was being made. The same shape appears in prescription histories sold to underwriters, in tenant screening reports, and in the credit header data that circulates well outside the credit system.
What distinguishes the car case is that the sensor was already there. Nobody had to deploy anything or persuade the driver to install an app. The vehicle had a modem, a manufacturer had a partnership, and the data started flowing. Our wider write-up on connected car privacy covers the rest of what a modern vehicle records, and the data broker opt-out guide covers the removal processes that work in practice.
The useful habit is to ask, of any device that reports back to a manufacturer, who else receives the report and what decision it feeds. That question has a concrete answer in the privacy policy often enough to be worth the five minutes, and when it does not, the absence is itself informative.