# AI in Auto Insurance: Follow the Driving Data From the Car to the Premium

> Auto insurers that deny, cancel or charge a customer more based on a reporting agency's telematics report owe a federal notice.

- Source: https://insureaiwire.com/ai-in-auto-insurance/
- Publication: InsureAI Wire
- Author: Simon Li
- Updated: 2026-11-02

---
Braking events recorded by a car can end up in an auto insurer's underwriting decision. The Federal Trade Commission's case against General Motors, concluded in January 2026, describes how. According to the FTC's complaint, GM collected [telematics](/glossary/telematics/) events from enrolled cars and sold them to Verisk and LexisNexis Risk Solutions, whose reports insurers then cited when denying coverage, cancelling policies, or raising premiums.[^1]

Those are the FTC's allegations, which GM neither admitted nor denied.[^2] The complaint names no insurer, and GM's obligations come from the order that closed the case. For any company that buys driving data, the case raises a practical question: if a driver disputed a score like this, what records could the company produce?

## One driving record, from the car to the premium

The complaint says that through OnStar Smart Driver, a feature drivers enrolled in, GM collected driving events such as hard braking, hard acceleration, and speeding over 80 miles per hour, along with the car's vehicle identification number (VIN) and precise location.[^3] Enrollment was bundled: one dealership screen offered Smart Driver and maintenance notifications under one accept button.[^4] The FTC called collecting and selling the data without affirmative express consent unfair under the FTC Act, and failing to disclose the sale deceptive.[^5]

GM sold the events to Verisk from 2016 and to LexisNexis from 2019, and the complaint calls both consumer reporting agencies (CRAs).[^3] Each tied the events to a driver through the VIN and compiled consumer reports typically holding about six months of driving.[^6]

Many drivers learned of these consumer reports only when an insurer sent an [adverse action notice](/glossary/adverse-action-notice/) denying or cancelling a policy, or raising the premium, because of negative information in them.[^6] This is the step where the [Fair Credit Reporting Act](/glossary/fair-credit-reporting-act/) (FCRA) attaches to the insurer. The FCRA treats a CRA's report used, or expected to be used, in deciding eligibility for personal insurance as a consumer report, and a denial, cancellation, or premium increase in underwriting as an adverse action.[^7] An insurer taking an adverse action "based in whole or in part on any information contained in a consumer report" must notify the consumer and name the CRA. It must also say the CRA did not make the decision and explain the rights to a free copy of the report and to dispute it.[^8]

According to the complaint, some drivers then got their LexisNexis consumer reports and complained to GM about hundreds of records of driving they had not known about.[^9] It says insurers acted on the CRAs' reports, but not at which stage, through which variables in a [filed rating plan](/glossary/rate-filing/), or with what effect on the premium.

## What the order means for insurers

The order, issued January 13, 2026, binds GM and OnStar, and anyone in active concert or participation with them who has notice of it. Insurers and CRAs carry no duty under it.[^10] GM must ask the companies it shared driving data with, such as Verisk and LexisNexis, to delete it, but under the order none of them has to, and neither does an insurer holding reports built from that data.[^11] According to the complaint, GM had already stopped sharing with the two CRAs in March 2024.[^6] For insurers' supply, the order keeps that route from reopening: for five years GM may not disclose covered driver data, meaning location and driving events and data derived from them algorithmically, to anyone acting as a CRA.[^12]

The American Property Casualty Insurance Association, an insurers' trade group, joined the Consumer Data Industry Association in asking the FTC to strike the five-year ban. In the FTC's quotation, the insurers' group pointed to "the harm to consumers, limits on competition for usage-based insurance programs, and burden on smaller insurers that the provision could create."[^13] The FTC issued the order unchanged. Its letters to the two groups, though not the order, added that GM drivers can still send driving data directly to insurers during the ban for usage-based discounts.[^13]

Consumers have also sued. Class actions against GM, LexisNexis, and Verisk over driving data were centralized in June 2024 as MDL 3115, a multidistrict case in the Northern District of Georgia.[^14]

**Status as of November 2, 2026.** The order's ban on disclosures to CRAs runs to about January 2031.[^12] MDL 3115 remained on the multidistrict panel's list of pending cases dated October 1, 2026.[^14] Separately, Oregon announced on October 29, 2026 that GM will pay $220 million to settle allegations from 36 attorneys general that it sold drivers' location and driving data to data brokers. The agreed judgment, without admission, takes effect November 30, 2026. It binds GM and OnStar, not insurers.[^37]

## Outside driving data beyond GM

Texas sued Allstate and Arity on January 13, 2025, over the same problem starting in a phone.[^15] The petition alleges that software in phone apps collected driving data from more than 45 million people, which Allstate and other insurers used at quote and renewal to raise premiums or deny coverage. It also alleges, on information and belief, that Arity's data could not reliably tell whether a person was driving, so a passenger could be scored for someone else's driving.[^15] That allegation goes to a basic question in any dispute over a driving score: whose driving it records.

A 2021 survey that nine states ran through the NAIC asked what data insurers' advanced models used and where it came from. The survey went only to private passenger auto writers with more than $75 million in 2020 direct written premium.[^16] It counted only "more advanced" AI and machine learning, leaving out generalized linear models and similar standard methods. By NAIC staff's estimate, that excluded about 80 percent of the models used in rating.[^17]

Within that scope, telematics was among the five data elements most used in advanced rating models, and all but one of the companies using it there drew some or all of it from outside.[^18] Yet advanced models themselves were still uncommon in rating: 27 percent of the 193 respondents had one in use there, and 18 percent in underwriting, against 70 percent in claims.[^19]

## The rules for rating, underwriting, and claims models

Driving data a driver sends straight to an insurer, as the FTC's letters described, does not arrive as a CRA's report. On our reading, an adverse action based only on that data would therefore not trigger the FCRA notice. In New York, [Circular Letter No. 7](/ny-dfs-circular-letter-7/) covers part of that gap in underwriting and pricing, though not claims, through the notices an insurer already sends.[^20] It treats data as external by how the insurer uses it, not where it came from, and excludes motor vehicle reports but not telematics. So we read its external data as including a telematics feed the driver sends.

A driving score used in rating is also subject to the state rating law, which requires that rates in [any property and casualty line](/ai-by-business-line/) not be excessive, inadequate, or unfairly discriminatory, however they are built. The NAIC's [model bulletin](/glossary/naic-model-bulletin/) on insurers' use of AI restates that requirement for rates built with AI and machine learning.[^21] As of October 8, 2026, the NAIC's adoption map listed 29 jurisdictions as having adopted it and California, Colorado, New York, and Texas as having their own insurance-specific regulation or guidance.[^22] The map does not decide whether each adopted text contains every element of the model.

Where the model bulletin is adopted, it expects a written program for AI used in underwriting, rating, claims, and fraud detection, whether built in-house or bought.[^21] It prescribes no specific documentation. Its program still covers a vendor's AI-built driving score along with the insurer's own models.

Colorado's Regulation 10-1-1 has applied to private passenger auto insurers since October 15, 2025. It governs [external consumer data and information sources](/glossary/external-consumer-data/) (ECDIS), meaning data used to supplement or supplant traditional underwriting factors or other insurance practices. For auto, ECDIS includes "consumer-generated Internet of Things data including telematics data" and insurance risk scores derived from such data.[^23]

An auto insurer using ECDIS must run a board-overseen framework designed to find [unfair discrimination](/glossary/unfair-discrimination/) with respect to race and to remedy what the Division of Insurance's [quantitative testing requirements](/glossary/colorado-quantitative-testing-rule/) detect.[^24] Until the Division adopts those requirements for auto, its Bulletin B-10.004, reissued June 10, 2026, excuses auto insurers from describing quantitative testing in their annual reports and says every other requirement of Regulation 10-1-1 stays in effect.[^25] So for a Colorado auto insurer using a telematics score, the framework duty does not wait for the testing requirements.

California's rating rule lets an insurer use a device only to determine actual miles driven, with voluntary participation, and bars using it to collect or store the car's location except for emergency road, theft, map, or travel services.[^26] [AB 311](/news/california-telematics-insurance-bill-privacy/), a 2025-26 bill that proposed opt-in telematics in California rating, was held in the Senate Appropriations Committee in August 2026, so the mileage-only rule stands as written.[^27]

Claims are where the survey found advanced AI most common, mostly in tools that [assisted adjusters](/ai-in-insurance-claims/).[^28] Under New York's physical damage claims rule, 11 NYCRR 216.7, an insurer that generates its estimate with electronic data processing equipment must furnish a copy at inspection or within 24 hours after it.[^29] An insurer that relies on the insured's estimate for a minor loss instead of inspecting is "nevertheless bound by all the applicable requirements of this Part."[^29] The section mentions neither photos nor AI. We read its copy duty as covering an AI photo estimate, since such an estimate is generated by that equipment, even when the insurer skips the inspection.

## The records a disputed driving score calls for

No rule requires one file that follows a driving score from source to correction, but as we read them, the rules above ask for its parts. The order shows what a consent record looks like. Subject to exceptions such as emergencies and safety, GM needs a separate, informed consent for each unrelated feature that collects or shares covered driver data.[^30] It must keep the specific consent notice each consumer viewed and the time and date of consent.[^31] An insurer can ask its vendor for the same record.

Under the model bulletin, a department examining an insurer may ask for a model's data source, provenance, and [data lineage](/glossary/data-lineage/), and for due diligence, contracts, and audits of its third-party data and model vendors.[^32] Regulation 10-1-1 requires an auto insurer using ECDIS to keep a version-controlled inventory of every ECDIS source and model, with purposes and outputs, to record how [vendors](/glossary/vendor-oversight/) supplying ECDIS were chosen, and to monitor drift.[^33] The insurer stays responsible for vendor-supplied data and models, though the vendor may send documents directly to the Division. An officer signs the annual compliance report.[^34]

The notice and the correction come mostly from New York's circular letter. A New York insurer should say, in any notice it already sends, whether it used AI and whether it used vendor data, and that the consumer may ask for the specific data behind the decision. Reasons for an adverse decision should name the data's source.[^35] The insurer may not rely on a vendor's proprietary algorithm to avoid giving specific reasons, and it should have procedures to report incorrect information to the vendor and remove it from its own AI systems.[^36] Regulation 10-1-1 requires a complaints process that gives the consumer what is needed to take meaningful action after an adverse decision based on ECDIS.[^33]

Our answer to the opening question is four records for each outside source of driving data: the data's origin and the driver's consent, the model and version that used it, the decision and the notice sent, and the correction of any wrong entry. For phone data, the origin record should also show how each trip was tied to the person driving.

[^1]: Federal Trade Commission, Complaint, In re General Motors LLC et al., Docket No. C-4828, issued January 13, 2026, ¶¶38 to 39 and 44 to 46. https://search.ftc.gov/system/files/ftc_gov/pdf/2423052c4828gmlexisfinalcomplaint.pdf
[^2]: FTC, Decision and Order, Docket No. C-4828, issued January 13, 2026. The respondents neither admit nor deny the complaint's allegations except as stated in the order. https://search.ftc.gov/system/files/ftc_gov/pdf/2423052c4828gmlexisfinalorder.pdf
[^3]: FTC Complaint, ¶¶38 to 40. Each event also carried a trip identifier and a time and date stamp.
[^4]: FTC Complaint, ¶¶9, 12, and 20 to 25. The complaint also says GM presented Smart Driver as a tool for drivers' own assessment (¶¶42 to 43).
[^5]: FTC Complaint, Count I (¶¶52 to 55) and Count II (¶¶56 to 58), under Section 5 of the FTC Act.
[^6]: FTC Complaint, ¶¶44 to 46. LexisNexis's reports listed each driving event record by record (¶45). Under ¶41, data sharing with Verisk and LexisNexis ended March 20, 2024, and Smart Driver was shut down June 26, 2024.
[^7]: 15 U.S.C. §1681a(d)(1)(A) and (k)(1)(B)(i) (2023 edition). The adverse action definition covers a denial, cancellation, increase in charge, or reduction "in connection with the underwriting of insurance." https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap41-subchapIII-sec1681a.htm
[^8]: 15 U.S.C. §1681m(a) (2023 edition). The notice gives the CRA's name, address, and telephone number, and must also disclose a numerical credit score if one was used. https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap41-subchapIII-sec1681m.htm
[^9]: FTC Complaint, ¶¶47 to 48.
[^10]: FTC Order, Provision I and the definition of Respondents (General Motors' operating and holding companies and OnStar).
[^11]: FTC Order, Provisions VI and VIII. Provision VI requires GM to delete the covered driver data it retained before the order took effect, unless the consumer has consented or one of that provision's exceptions applies. Provision VIII requires GM to ask the companies it shared that data with to delete it.
[^12]: FTC Order, Provision I and Definition E. The ban runs five years from the order's entry. Definition E gives examples such as hard braking, crossing a set high-speed threshold, seat belt use, and late-night driving, and excludes deidentified data and a vehicle's build, trim, make, model, and year.
[^13]: FTC, Letters to Commenters, Docket No. C-4828, January 13, 2026 (letters to the American Property Casualty Insurance Association and the Consumer Data Industry Association). The letters describe drivers sending data to insurers through apps and onboard devices. https://search.ftc.gov/system/files/ftc_gov/pdf/2423052c4828gmlexiscommenterletters.pdf
[^14]: Judicial Panel on Multidistrict Litigation, Transfer Order, MDL No. 3115, In re: Consumer Vehicle Driving Data Tracking Litigation, centralizing the actions in the Northern District of Georgia, filed June 7, 2024, https://www.jpml.uscourts.gov/sites/jpml/files/MDL-3115-Transfer_Order-5-24.pdf; Pending MDL Dockets by District, October 1, 2026, https://www.jpml.uscourts.gov/sites/jpml/files/Pending_MDL_Dockets_By_District-October-1-2026.pdf
[^15]: State of Texas v. The Allstate Corporation et al., Plaintiff's Original Petition, District Court of Montgomery County, dated January 13, 2025, ¶¶1 to 5 and 40 to 41. The petition pleads the Texas Data Privacy and Security Act and the Texas data broker law against the Arity defendants, and the Texas Insurance Code's ban on unfair or deceptive acts in the business of insurance against all defendants. https://www.texasattorneygeneral.gov/sites/default/files/images/press/Allstate%20and%20Arity%20Petition%20Filed.pdf Texas Attorney General release, January 13, 2025: https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-allstate-and-arity-unlawfully-collecting-using-and-selling-over-45
[^16]: NAIC staff report, "Private Passenger Auto (PPA) AI/ML Survey Results," December 8, 2022, p. 6. The survey ran under the market conduct examination authority of Connecticut, Illinois, Iowa, Louisiana, Nevada, North Dakota, Pennsylvania, Rhode Island, and Wisconsin, with responses national in scope. The survey documents state the threshold two ways: more than $75 million in 2020 direct premium written (this report, p. 6) and at least $75 million in national private passenger auto premium (the NAIC data-call page). The call letter went out September 28, 2021, with responses requested by October 28, 2021. https://content.naic.org/sites/default/files/inline-files/PP%20Auto%20Survey%20Team%20Report%20120822.pdf
[^17]: NAIC staff report, pp. 7 to 8. Also excluded: generalized additive models, linear regression, rating factor tables, and anything usable in 2000 or earlier. A static model built with machine learning stayed in scope. The 80 percent estimate is judged from the models submitted to the NAIC's rate model review team, and the report has "no information about the impact of this definition on the reporting of models for companies' non-rating operations."
[^18]: NAIC staff report, p. 26 and Table 25 (telematics used in advanced rating models by 27 companies); pp. 27 to 28 and Table 26 (telematics sourced internally only by 1 company, externally only by 9, both by 17; "driving behavior," which the survey defines as tickets, years of driving experience, or annual miles driven, sourced externally only by 27 and both by 6).
[^19]: NAIC staff report, p. 9 and Table 3. Shares of the 193 respondents with models in use: claims 70%, marketing 50%, fraud detection 49%, rating 27%, underwriting 18%, loss prevention 2%. The report says the rating and underwriting results are "purposely affected" by the definition.
[^20]: New York Department of Financial Services, Insurance Circular Letter No. 7, July 11, 2024, paragraphs 5, 6, 8, 38, and 39. Paragraph 38 ties the letter's notice expectations to notices insurers already give. https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07
[^21]: NAIC, Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023, Section 1 (paragraph on the Property and Casualty Model Rating Law, Model #1780); Section 3 and items 1.6 and 1.8 (the written "AIS Program"); Section 4, closing paragraph. https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-ai-model-bulletin.pdf.pdf
[^22]: NAIC, adoption map for the AI model bulletin, status as of October 8, 2026. The 29 adopting jurisdictions are 27 states, the District of Columbia, and Puerto Rico. The map does not reflect a determination as to whether an adopted text contains all elements of the model. https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf
[^23]: Colorado Division of Insurance, Amended Regulation 10-1-1, 3 CCR 702-10, Sections 3.B, 4.D.2, and 11 (amended regulation effective October 15, 2025). Section 4.I excludes from "Internet of Things" devices "that require direct human intervention for data collection and exchange." https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework
[^24]: Regulation 10-1-1, Sections 5.A and 5.A.2.
[^25]: Colorado Division of Insurance, Amended Bulletin B-10.004, issued October 18, 2024 and reissued June 10, 2026, Sections III and V. Section I states that bulletins "establish neither binding norms nor finally determine issues or rights." https://doi.colorado.gov/sites/doi/files/documents/Revised%20Bulletin%20B-10.004%20Concerning%20the%20Quantitative%20Testing%20Reporting%20Requirements.pdf
[^26]: Cal. Code Regs., tit. 10, §2632.5(c)(2)(F), as reproduced by the Legal Information Institute. https://www.law.cornell.edu/regulations/california/10-CCR-2632.5 The device provisions, (c)(2)(F)(i)5.a and 5.b and (c)(2)(F)(iv), come from the amendment text filed October 16, 2009, approved by the Office of Administrative Law October 15, 2009 (California Department of Insurance Advisory Notice, October 19, 2009). https://www.insurance.ca.gov/0400-news/0100-press-releases/0080-2009/upload/PAYDFINALTXTFILED101609.pdf
[^27]: California Senate Appropriations Committee, hearing results, August 3, 2026: AB 311 (McKinnor), the Consumer Driving Data Protection Act of 2026, placed on the suspense file (7 to 0). https://sapro.senate.ca.gov/system/files/2026-08/hearing_results-8-3-26.pdf Suspense hearing of August 13, 2026: "Hold in committee," according to the committee's Unofficial Results. https://sapro.senate.ca.gov/media/564
[^28]: NAIC staff report, pp. 10 to 12, Tables 4 to 6, and Appendix B, p. 62. The information-resource use was reported by 96 companies. Image-evaluation models in use or under construction: 201 augmentation (the model suggests an answer to a person), 16 automation, 35 support (counts of models, not companies); 72% of image-evaluation models were developed by third parties. No respondent reported an advanced model that denies a claim "without human intervention on that particular claim," the survey's definition of a claims-denial model, so the survey leaves open AI's part in denials a person signs. Nine companies reported models that approve claims without human intervention.
[^29]: 11 NYCRR 216.7(b)(1), (b)(3)(ii), and (b)(10), as reproduced by the Legal Information Institute. Under (b)(1), the insurer has six business days after notice of claim to inspect a damaged car before repair. Paragraph (b)(3) sets separate rules for estimates prepared by hand and estimates generated by electronic data processing equipment. https://www.law.cornell.edu/regulations/new-york/11-NYCRR-216.7
[^30]: FTC Order, Provision II. Its exceptions also cover consumer-initiated services, legal compliance, deidentified research and development other than marketing, quality and recall work, and diagnostics.
[^31]: FTC Order, Provision XIV.F. Provision XIV requires records to be created for 20 years and each kept for 5 years.
[^32]: NAIC Model Bulletin, Section 4, items 1.3(c)(ii)(2) and 2.1 to 2.4. Under Section 3, item 4.2, contract terms on audit rights and cooperation with regulators are sought "where appropriate and available."
[^33]: Regulation 10-1-1, Sections 5.A.7, 5.A.9, 5.A.12, and 5.A.13.
[^34]: Regulation 10-1-1, Sections 5.B, 6.A, 6.C, 6.D, and 7. A progress report was due December 1, 2025, and the first compliance report July 1, 2026, then annually. The report runs to no more than ten pages; an insurer whose officer cannot attest to compliance files a corrective action plan. Filings are confidential.
[^35]: Circular Letter No. 7, paragraph 39. Paragraph 38 ties written reasons to Insurance Law §§3425 and 3426, which govern cancellation and nonrenewal of property and casualty policies.
[^36]: Circular Letter No. 7, paragraphs 36 and 40.
[^37]: Oregon Department of Justice, news release, October 29, 2026, https://www.doj.state.or.us/media-home/news-media-releases/ag-rayfield-leads-states-in-220m-settlement-w-gm-over-drivers-private-data/; Stipulated General Judgment and Money Award, State of Oregon ex rel. Rayfield v. General Motors LLC et al., Multnomah County Circuit Court, preamble, definition of Effective Date, and paragraphs 28, 72 and 76 to 77 (paragraph 28 applies the duties to the defendants and their successors), https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-29-SGJ-Final-with-Exhibit-and-Cert.pdf