Ask most drivers what their car "knows" about them and you'll get a shrug — maybe a joke about the backup camera. Ask a claims adjuster the same question and you'll get a very different answer. Your 2022 Chevy Bolt logs your hard-braking events down to the tenth of a second. Your Honda Pilot records how often you exceed 80 mph and for how long. Your Toyota knows exactly when you last skipped an oil change, because the dealership network flags it automatically. None of that is a hidden camera in the glovebox. It's telematics — the always-on data connection built into nearly every new vehicle sold in the United States since around 2018 — and for years, most of it was quietly sold to companies you've never heard of.
The wake-up call came in March 2024, when a New York Times investigation traced a chain that started with GM's OnStar Smart Driver program and ended with insurance premium hikes. Drivers who'd enrolled — often without fully realizing it, through an in-app prompt during setup — found their driving scores had been sold to LexisNexis Risk Solutions and Verisk, two data brokers that build consumer risk profiles for the insurance industry. Some drivers saw their renewal quotes jump by $500 to $1,500 a year with no accident, no ticket, nothing on their record to explain it. The only difference was that their insurer had bought a report showing how often they braked hard or drove past midnight.
What Your Car Is Actually Recording
Modern vehicles collect far more than the odometer readings you'd expect. GPS location logged at intervals as tight as every few seconds. Speed relative to posted limits, pulled from onboard mapping data. Acceleration and braking force, seatbelt status, phone-pairing events, even how many times you open specific doors. Ford's Connected Vehicle platform and GM's OnStar system have been doing this since well before 2020 for diagnostics and safety features — the crash-detection call that auto-dials 911 needs that data stream to work. The part that changed is what happens to the data after the safety feature is done using it.
Mozilla's Foundation ran a privacy audit of 25 major car brands in 2023 and rated every single one as failing basic consumer privacy standards — the worst score of any product category the foundation had ever reviewed, beating out even mental health apps. Nissan's own privacy policy at the time claimed the right to collect "sexual activity" and "genetic information," language most researchers believe was boilerplate copied from a generic legal template rather than an actual feature, but it illustrates how far the fine print reaches. Reading a modern car's privacy policy takes, on average, longer than reading the actual owner's manual.
OnStar Smart Driver and the LexisNexis Pipeline
Here's the part most owners never see coming.
GM's Smart Driver program is opt-in on paper, but the opt-in prompt lives inside the myChevrolet or myGMC app, buried past a screen that promises "personalized driving insights" with no mention of insurance. Once enrolled, GM shared trip-level driving behavior with LexisNexis Risk Solutions, which compiles it into a report format insurers already use for claims history — the same kind of report you'd get pulled if you'd been in an accident. Several insurers, including ones GM had commercial partnerships with, used those reports to reprice policies at renewal. GM pulled the plug on the LexisNexis and Verisk data-sharing arrangement in March 2024 after the Times story and a wave of customer lawsuits, and Texas Attorney General Ken Paxton filed suit against the company in August 2024 alleging the program violated the state's Data Privacy and Security Act. That lawsuit is still working through the courts.
It's Not Just One Automaker
Honda's HondaLink and Kia's UVO systems have faced similar scrutiny, and Hyundai disclosed in its own privacy documentation that it shares driving data with LexisNexis as well. Subaru's Starlink and Toyota's Connected Services carry comparable data-sharing clauses, though enforcement and actual insurer partnerships vary by brand and haven't all been reported publicly with the same detail GM's case got. Tesla is a separate case entirely — its telemetry feeds the company's own insurance product (Tesla Insurance, priced using a proprietary Safety Score) rather than an outside broker, which some owners find more transparent and others find more invasive, since there's no third party to opt out of.
Don't assume a brand is clean just because it hasn't made headlines yet. The absence of a scandal usually means the reporting hasn't caught up, not that the data pipeline doesn't exist.
This Is Different From Progressive Snapshot
It's worth drawing a clear line here, because the two get lumped together constantly. Progressive's Snapshot, State Farm's Drive Safe & Save, and Allstate's Drivewise are opt-in apps or plug-in devices you install specifically to earn a discount — you know exactly which insurer sees the data, because you signed up with that insurer directly, and you can uninstall the app the day you decide the trade isn't worth it. The automaker programs described above work backward: the data collection starts the moment you activate any connected service, often during the test drive or the first week of ownership, and the insurance company on the receiving end isn't one you chose. You may not even be a customer of the insurer buying your risk score. That's the distinction that got GM sued — not that driving data gets used for insurance at all, but that owners had no idea which company was seeing it or that it was being sold as a third-party report rather than used internally.
The Legal Patchwork: What Protects You
California's Consumer Privacy Act, strengthened by the CPRA in 2023, gives residents the right to know what's collected and to opt out of its sale — and California's attorney general has specifically named connected-car data as an enforcement priority. More than a dozen other states, including Colorado, Virginia, Connecticut, and Texas, have passed broad consumer-privacy statutes with varying opt-out rights since 2023. But there's no federal law that covers this the way HIPAA covers medical records, and if you live in a state without one of these laws — most of the Midwest and South still don't have one on the books as of 2026 — your only real leverage is the automaker's own opt-out mechanism, which brings us to the part that actually matters: turning it off.
How to Check What Your Automaker Has on You
Every major automaker is required to provide a data disclosure report if you ask for one, similar to a credit report. GM, Honda, Toyota, and Hyundai all have online request forms — search "[brand name] connected services privacy request" and you'll find them within a couple of clicks. Expect a response window of 30 to 45 days. The report typically shows what categories of data were collected, not the raw trip logs themselves, so don't expect a map of every drive to your ex's house. It's a summary, not a diary.
Turning It Off, Brand by Brand
GM owners: open the myChevrolet, myGMC, myBuick, or myCadillac app, go to Account Settings, then Data Privacy, and disable Smart Driver along with any "Marketing Communications" data-sharing toggle — they're listed separately and both need to go. Honda and Acura owners can call 1-888-982-6564 or use the HondaLink privacy portal to request opt-out; there's no in-app toggle as of this writing, which tells you something about how much friction Honda wants in that process. Toyota and Lexus drivers manage this through the Toyota Financial Services / Connected Services account portal under "Data Privacy Preferences." Hyundai and Kia route requests through their respective "Privacy Rights Request" web forms rather than the app.
A few things to know before you do this:
- Opting out of data sharing is not the same as disabling the telematics hardware — the crash-response and stolen-vehicle-tracking features usually stay active even after you opt out of the marketing and insurance-sharing pieces, and that's generally worth keeping
- Some opt-outs take a full billing cycle to process, so don't panic if the toggle looks flipped but a data report shows old settings for a few weeks
- Leased vehicles sometimes route connected-services consent through the leasing company rather than the manufacturer directly, which adds a call to your lender you weren't expecting
What You Actually Give Up
Turning off data sharing doesn't disable your car. Automatic crash notification, stolen vehicle recovery, and remote start typically survive an opt-out untouched, because those run on the vehicle's own telematics control unit rather than the marketing data pipeline. What you lose is usage-based insurance discount eligibility through the automaker's own program — GM's Smart Driver discount, for instance, can shave 10–15% off a policy for genuinely careful drivers who don't mind being watched. If you're a cautious driver with a clean record already, that trade might be worth reconsidering rather than blanket-opting-out. If you're anyone else, the downside risk of a silent premium hike outweighs a discount you may not even qualify for.
The honest recommendation here is simple: request your data disclosure report first, then decide. Don't opt out blind and don't leave it on by default either — both are guesses, and this is a decision you can actually make with real information in front of you. Set a reminder to redo the disclosure request annually, because these programs change their data-sharing partners more often than the fine print gets updated in your inbox.