Can Insurance Companies Track Your Car?

Four Different Things People Call “Tracking”

Every one of these channels starts at the same place: the Controller Area Network bus — the internal wiring loom that lets a car’s electronic control modules talk to each other without a central computer. The engine control module publishes a speed value onto the bus, the transmission module reads it, the instrument cluster reads it, and any other device wired to that bus can read it too.

The standardized doorway into that bus is the On-Board Diagnostics II port under the steering column. Federal emissions regulation at 40 CFR § 86.1806-05 requires light-duty vehicles to carry an on-board diagnostic system meeting standardized specifications, which is why a $40 scan tool works on a Corolla and an F-150 alike.^[5] A device plugged into that port sends a request carrying a Parameter ID — the request for vehicle speed, for instance, is a specific two-byte code — and the relevant control module answers with the raw value. The dongle converts that hexadecimal answer into miles per hour and forwards it.

A factory Telematics Control Unit skips the port entirely. It is an embedded communications gateway wired straight into the vehicle’s electrical architecture, carrying its own embedded SIM and cellular modem. It reads the same bus traffic, but it does not need a driver, a phone, or a plug-in device to move that data — it dials out on its own connection. That is the hardware behind connected-services brands like OnStar, FordPass, and HondaLink.

The fourth item on the list is the one drivers most often confuse with the others. An Event Data Recorder is not a continuous telematics feed. It is the automotive equivalent of a flight recorder, and the National Highway Traffic Safety Administration’s rule at 49 CFR Part 563 governs which data elements it captures around a crash and how those elements are retrieved.^{[4] [3]} Part 563 data is ordinarily held in the module for post-crash retrieval rather than streamed anywhere, which is why it surfaces in crash reconstruction and fault disputes rather than in a monthly premium calculation. Part 563 governs the recorder, not the rest of the car — a vehicle can contain both an EDR and separate connected-car hardware that does transmit, so the presence of an EDR is neither evidence of tracking nor evidence against it.

Insurers also deploy a fifth variant that sits between the dongle and the phone: a small Bluetooth beacon mounted to the windshield that the phone app pairs with, so the software knows a trip belongs to the insured vehicle rather than a bus ride. We cover that hardware in detail in our research on what a beacon is for car insurance.

How a Phone in a Cup Holder Measures Your Braking

A phone is an attractive telematics sensor for one reason: the insurer does not have to manufacture, ship, or support it. The hardware is already in the driver’s pocket, and it is good hardware. Microelectromechanical accelerometers measure change in velocity across three axes in meters per second squared, gyroscopes measure angular rotation in degrees per second, and the GPS receiver fixes position against satellite timing.

The engineering problem is that the phone is not bolted to the car. It sits loose in a cup holder or slides around a passenger seat, so its X, Y, and Z axes point wherever gravity and friction left them — not along the car’s forward axis. A raw accelerometer reading taken from a phone lying face-down in a door pocket describes the phone’s motion, not the vehicle’s deceleration.

Sensor fusion resolves that. The software first uses the constant one-gravity pull to work out which way is down, then uses the GPS heading during steady cruising to work out which way is forward, and from those two vectors it builds a rotation that maps phone axes onto vehicle axes. Every later accelerometer sample is passed through that rotation before it is scored, which is how a braking event measured by a phone in a purse still lands in the right column.

GPS then fails in exactly the places people drive most — tunnels, parking structures, and urban canyons where tall buildings bounce the satellite signal and corrupt the position fix. The software falls back to dead reckoning: it takes the last trustworthy fix and integrates accelerometer and gyroscope output forward to estimate how far, how fast, and in what direction the car has moved since. The result is buffered in phone memory and uploaded when cellular service returns, so a lost signal delays the data rather than erasing it.

Insurers rarely build any of this themselves. They license software development kits from specialized telematics vendors and embed them in their own branded apps. The consequence is that the same tracking engine can appear in an app that has nothing to do with insurance — a point state regulators have taken up directly, covered further below.

What the Car Actually Sends: The OnStar Record

Most descriptions of connected-car data collection are vague because the companies treat the specifics as proprietary. The Federal Trade Commission’s complaint against General Motors and OnStar is the exception. It is a public federal document, and it names the collection tasks and their triggers.^[2]

The complaint describes the Smart Driver feature as running two distinct background tasks. One collected precise position — latitude and longitude to six decimal places, plus elevation, heading, and speed — every three seconds from ignition on. Six decimal places resolves to roughly a tenth of a meter, which is not “which neighborhood” precision; it is “which parking space” precision. The second task collected a record whenever a specific event fired — a hard brake, a hard acceleration, an unbuckled seatbelt, an ignition cycle, or a speed above 80 miles per hour — and the records collected that way were transmitted as a bundle after the ignition switched off at the end of the trip. Collection and transmission are two separate stages: the car logs while you drive and reports once you park.^[2]

The consent question is where the complaint turns sharp. The FTC alleged that the enrollment interface warned a consumer that declining the terms would deactivate emergency services and automatic crash response — bundling behavioral tracking with the safety feature people actually bought the subscription for. Regulators call that design a dark pattern: the choice is technically present, but the cost of choosing correctly is made unacceptable.^[2]

The Trip From Your Car to an Underwriter’s Screen

Automakers do not sell you insurance, so for telemetry to become money it has to change hands. Regulators have alleged one specific version of that chain: General Motors’ connected-services platform collected the data, a data broker received it, and the broker supplied the resulting driving report to insurers during underwriting. That is the pattern alleged in the FTC and Texas filings against GM — not a demonstrated description of how every automaker or broker operates.^{[1] [12]}

That final step can carry a legal consequence, but only for companies that actually meet the statutory definition. The Fair Credit Reporting Act attaches its disclosure and dispute obligations to a consumer reporting agency — and whether a particular company handling driving data qualifies turns on what it assembles and how the recipients use it, not on the fact that it touches telematics.^[10] Where the question is already settled, the answer is published: the Consumer Financial Protection Bureau lists LexisNexis C.L.U.E. and Telematics OnDemand among the consumer reporting companies a consumer can request a file from.^[9]

For those identified agencies, that is the most useful fact in this report. The driving file stops being a black box you have to speculate about — you can request a copy, read the trip-by-trip contents, and dispute entries you believe are wrong, the same way you would dispute a misattributed credit-card account. For a company not on that list, the first question is whether it is a consumer reporting agency at all, which is a different and less settled inquiry. The same disclosure mechanism that lets you audit a claims history, described in our research on who can see your car insurance claims, is the one at work here.

How One Hard Stop Becomes a Dollar Figure

An insurance rate is the output of a Generalized Linear Model — a regression framework that, unlike ordinary least-squares regression, can handle response variables whose errors are not normally distributed. Actuaries need that because claim data breaks the assumptions of plain linear regression twice over: a premium or claim count cannot be negative, and claim costs are severely right-skewed, with a mass of small fender-benders and a long tail of catastrophic liability claims.

So the pricing calculation splits in two. A frequency model estimates how often a given driver will file, typically using a Poisson or negative binomial distribution because claims are discrete countable events. A severity model estimates how expensive each claim will be if it happens, using a Gamma or inverse Gaussian distribution to respect that skew. Multiply the two and you have the expected loss for the policy, which is the foundation the final premium is built on.

Telematics does not fit that machine directly. A GLM expects tidy tabular inputs — the driver is 35 years old, the vehicle is a 2021 sedan. A month of telematics produces tens of thousands of GPS fixes, speed samples, and event flags. Feeding that raw stream into the rating model would produce something no state insurance regulator could audit for unfair discrimination, and filed rating plans have to be explainable.

The industry’s answer is to compress before it prices. Machine-learning models sit outside the official rating formula, ingest the raw trip history, find the non-linear patterns in it, and collapse the whole thing into a single scalar — the safety score. That one number is then inserted into the GLM as a rating variable sitting alongside age and vehicle type, which keeps the filed rating plan interpretable while still capturing the predictive signal.^[19]

This is why a driver cannot point to one hard stop and trace a specific dollar amount to it. The braking event is one input among thousands feeding a compression model whose output is a single score, and that score is one coefficient among dozens in the rating formula. The effect is real and it is priced — it is simply not itemized.

Usage-Based Insurance: What You Are Actually Enrolling In

When an insurer prices a policy from tracked driving, the product category is Usage-Based Insurance. The NAIC divides it along a clean line: programs that price on how much you drive, and programs that price on how you drive.^[6] Pay-as-you-drive pricing reads odometer or trip-distance data and rewards low annual mileage. Pay-how-you-drive pricing adds the behavioral layer — braking force, acceleration, cornering, time of day — and scores it.^[7]

The enrollment pattern is consistent across carriers, and it is worth understanding before signing up. Most programs open with a participation discount granted simply for enrolling, followed by a monitoring period, with the real adjustment applied at the next renewal once a score exists. The discount you see on day one is therefore not the price you have agreed to; it is the price of the trial.

That adjustment does not only move downward. The Maryland Insurance Administration’s 2025 telematics survey of the state’s auto market documented policies whose premiums increased at renewal as a direct result of telematics-score adjustments, alongside the larger population that received discounts.^[8] A state regulator collecting that data from carriers is a materially different evidence class than a marketing page promising savings.

The Apps You Would Never Guess Were Tracking Your Driving

Because the tracking engine is a licensable software kit rather than a bespoke build, nothing about the technology confines it to insurance apps. Any application a user has already granted location and motion permissions to is a technically viable host for it, which is the basis of the enforcement action below.

In January 2025, the Texas Attorney General sued Allstate and its telematics subsidiary Arity, alleging that they collected, used, and sold driving data from millions of people gathered through third-party mobile applications, including Life360, without the disclosure and consent Texas law requires.^[11] The same office had already sued General Motors in 2024 over the collection and sale of driver-behavior data from its connected vehicles.^[12]

The practical takeaway is narrow and specific, and it follows from what Texas has alleged rather than from a proven industry-wide practice: if those allegations are borne out, driving data can be collected from someone who never enrolled in a telematics insurance program, because the collection point was an unrelated app. Reviewing the location permissions granted to the apps on a phone therefore belongs in the same exercise as checking a vehicle’s connected-services settings.

What Regulators Have Actually Penalized

Two distinct legal theories run through connected-vehicle data cases, and it is worth keeping them apart. The deception theory, which the FTC pressed against General Motors and OnStar, is that consent obtained through a misleading interface is not consent — and those remain allegations resolved by a settlement order, not findings of liability.^[1] The second theory is narrower and has produced concluded state penalties: that a company obstructed consumers trying to exercise privacy rights they already had. The two California actions below are of that second kind, and both concern privacy-request friction rather than the sale of driving data.

The Honda action is the most instructive for a driver trying to exercise their rights today. The agency penalized Honda for demanding excessive identifying information before it would process an opt-out request — verification that the statute does not require for a simple opt-out — and for an asymmetrical interface where accepting tracking took one click while refusing took several.^[13] The Ford action closed the adjacent loophole: valid opt-out requests were silently discarded when consumers did not complete an unnecessary email-verification step.^[14] If an opt-out process feels deliberately difficult, that experience is the documented enforcement pattern, not a personal failure to find the right menu.

Why California Is Different

Privacy law governs whether data may be collected. Insurance law governs whether it may be used to set a price, and those are separate questions decided by separate agencies. California is the clearest illustration of the gap.

Proposition 103, approved by California voters in 1988 and codified at California Insurance Code § 1861.02, requires that an automobile rate be determined by three mandatory factors in decreasing order of importance — the insured’s driving safety record, the number of miles driven annually, and the number of years of driving experience — plus any additional factors the Insurance Commissioner adopts by regulation and that have a substantial relationship to risk of loss.^[15] Behavioral telematics scoring does not sit in that hierarchy by default, which is why California insurers generally offer verified-mileage discounts rather than braking-and-acceleration scores.

The result is a genuine split. A California driver’s hard-braking data can still be collected by the automaker and moved through the same commercial pipeline that operates everywhere else. What differs is the rating side: in California a behavioral telematics variable is not one of the three mandatory factors, so it could only enter a rate as an additional factor the Insurance Commissioner has adopted by regulation and that bears a substantial relationship to risk of loss.^[15] Whether any particular behavioral factor has cleared that process is a question about the Department of Insurance’s current regulations and approved rate filings, not one the statute answers on its own — check those filings before assuming either way.

Commercial Trucks: Tracking That Is Not Optional

Insurer-sponsored telematics programs generally require a driver to enroll and consent, though what that consent must disclose — and whether a given enrollment flow obtained it validly — varies by jurisdiction and program, which is the whole subject of the enforcement actions above. Commercial vehicle tracking skips that debate, because it runs on federal mandate. Drivers subject to the hours-of-service rules must generally record their duty status using an electronic logging device, replacing the paper logbooks that were easy to round, backdate, and falsify.^{[16] [17]}

The device wires into the engine control module rather than sitting beside it. It detects motion automatically, switches the driver’s status to driving on its own, and records engine hours, miles, and location without the driver touching anything — which is the entire point, since a log that requires a decision can be falsified by making a different one.^[16]

One detail matters for the privacy comparison. The electronic logging device specification deliberately does not capture a street address. Location is recorded at a coarser resolution — distance and direction relative to a nearby named place — which is enough to verify an hours-of-service log without building a turn-by-turn map of a driver’s day.^[16] The federally mandated tracker is, on that specific axis, less invasive than the voluntary consumer feature the FTC alleged was collecting six-decimal-place coordinates every three seconds.^[2]

How to Find Out What Your Car Has Reported — and Stop It

Request your consumer disclosure report. The CFPB lists LexisNexis C.L.U.E. and Telematics OnDemand among the consumer reporting companies you can request a file from, so start with those: ask for the file they hold on you and read the trips, timestamps, and flagged events it contains.^[9] This is the only step that replaces speculation with the actual record.

Dispute anything inaccurate. The Fair Credit Reporting Act gives you a dispute right against a consumer reporting agency for inaccurate entries, which matters when a file mixes in trips driven by a family member or a prior owner of the vehicle.^[10]

Open your automaker’s privacy portal, not just the infotainment menu.The data-sharing toggle inside the car and the privacy request form on the manufacturer’s website are different controls. The CPPA actions turned on how those request processes were built, so submit the formal request and keep the confirmation.^{[13] [14]}

Audit location permissions on every app, not only insurance apps. The Texas action against Allstate and Arity centered on data gathered through unrelated consumer apps, so an app with no apparent connection to insurance can still be the collection point.^[11]

Use the manufacturer’s documented controls, and weigh what turning them off costs you.Canceling a connected-services subscription or switching off the documented data-sharing settings are the supported ways to reduce what leaves the vehicle. Work from your automaker’s published privacy controls rather than modifying vehicle hardware: the same module often carries automatic crash notification and emergency SOS, and altering it can affect those safety functions and your warranty. If a privacy request is being obstructed, that is a complaint for your state privacy regulator.^[14]

Common Misconceptions, Corrected

“The black box in my car reports to my insurer.” The Event Data Recorder is not the reporting channel. Part 563 governs the crash data elements an EDR records and how they are retrieved, and that data is ordinarily held in the module for post-crash retrieval rather than streamed.^[3] Continuous tracking comes from a Telematics Control Unit, a dongle, or a phone — which a vehicle can carry alongside its EDR.

“If I never enrolled in a tracking program, no one has my driving data.”Not necessarily. The enrollment may have happened at the dealership as part of connected-services setup, or through an unrelated app’s terms of service.^[11]

“Telematics only ever lowers your rate.”A state regulator’s own survey of the Maryland market recorded premium increases applied at renewal following telematics-score adjustments.^[8]

“There is nothing I can do about it.” Where an identified consumer reporting agency holds the file — the CFPB lists LexisNexis C.L.U.E. and Telematics OnDemand — the Fair Credit Reporting Act gives you disclosure and dispute rights over it.^{[9] [10]} Separately, California’s privacy regulator has penalized Honda and Ford for obstructing privacy requests — a different problem from the sale of driving data, with its own remedy.^{[13] [14]}

“Turning off GPS stops the tracking.” It degrades one input. Sensor-fusion software falls back to accelerometer and gyroscope dead reckoning during signal loss, and a factory Telematics Control Unit reads vehicle speed and behavior off the internal bus regardless of satellite reception. A cybersecurity point follows from the same architecture: because these systems are permanent network endpoints, NHTSA treats vehicle cybersecurity as a safety discipline in its own right.^[18]