Your Car Has Been Reporting on You. Minnesota's Privacy Law Isn't the One That Makes Your Insurer Explain.

Plenty of GM drivers found out how they drive from their insurance company.

No, really. Per the Federal Trade Commission’s complaint, “Many consumers discovered these consumer reports only after receiving adverse action notices from insurance companies.” The reports logged hard braking, high speed, and late-night driving, event by event. The notices said coverage was denied or cancelled, or the premium went up.

What had they signed up for? Something GM presented, in the FTC’s words, as “a game-like tool for consumers’ own assessment of their driving habits”. Badges. Streaks. GM’s own description told them the feature “is not intended as an assessment of your compliance with driving laws or guidelines.” It was a game, the FTC says, right up until somebody priced it. One customer told GM’s service line: “When I signed up for this, it was so OnStar could track me. They said nothing about reporting it to a third party. Nothing.”

The FTC finalized its order against GM in January 2026. Minnesota’s Consumer Data Privacy Act took effect in July 2025. Two shiny new tools for a Minnesota driver, right? Sort of. The privacy act steps aside at the two points where your driving data costs you money. The law that actually makes your insurer explain itself was passed in 1989.

From the dashboard to your premium, as the FTC tells it

All of this is what the FTC alleged. GM settled, and apart from the facts needed for jurisdiction, it didn’t admit or deny a word of it.

The complaint describes two data streams. The first, which it calls “Task A”, pulled precise location from OnStar-equipped vehicles every three seconds, from the moment the ignition came on. The coordinates were “intended to be precise up to six decimal places by contractual requirements with third parties, which could pinpoint geolocation accuracy to approximately 111 millimeters, or 4.5 inches”. Four and a half inches. That’s not your neighborhood. That’s your parking spot. And it didn’t stay small. GM grew that collection from around 500,000 vehicles to approximately nine million.

The second stream, “Task B”, ran for drivers enrolled in OnStar Smart Driver. It captured driving events, including hard acceleration, hard braking, speeding over 80 miles per hour, and seat-belt use, each tied to the vehicle identification number and a time stamp. GM sold that data to several buyers, and two of them were consumer reporting agencies: Verisk, under a contract amended in December 2016, and LexisNexis Risk Solutions, under a contract signed in August 2019. They used the VIN to tie the events back to a person and built consumer reports “typically containing six months’ worth of driving events.” Then insurers used them. Car, to reporting agency, to insurer, to your mailbox.

GM wasn’t alone. In a July 26, 2024 letter to the FTC, Senators Ron Wyden and Edward Markey reported what automakers told Senator Wyden’s office. Honda shared data from 97,000 cars with Verisk between 2020 and 2024, and Verisk paid Honda $25,920. That’s 26 cents per car. Hyundai shared data from 1.7 million vehicles between 2018 and 2024 for $1,043,315.69, or 61 cents per car.

Sixty-one cents. That’s what a Hyundai driver’s habits sold for. Guess what they were worth to the people pricing the policy.

What the FTC ordered, and what it couldn’t touch

The FTC announced a proposed order on January 16, 2025, and billed it as “the FTC’s first action related to connected vehicle data.” The final Decision and Order, FTC Docket No. C-4828, issued January 13, 2026, and was announced the next day. Almost a year later, the operative terms hadn’t budged.

The headline is Provision I. GM “must not disclose Covered Driver Data to any person when that person is acting in the capacity of a Consumer Reporting Agency, for five years from the entry of this Order.” The whole order runs 20 years, and over that life GM also has to:

• get a driver’s affirmative express consent, within 180 days of the order’s effective date, before collecting, using, or sharing that data with a third party, with listed exceptions such as emergency responders;
• give every U.S. consumer a way to request a copy of the data and ask that it be deleted;
• let drivers turn off location collection, if the vehicle has the technology for it; and
• delete previously retained driver data within 180 days, again with listed exceptions.

Now, what’s not in it. By GM’s own public account, as the complaint describes it, GM ended data sharing with Verisk and LexisNexis on March 20, 2024, and shut down Smart Driver entirely on June 26, 2024. The five-year ban locked a door GM had already closed. The order binds GM, plus anyone acting in active concert with GM who gets actual notice of it, and that’s it. Honda, Hyundai, Verisk, and LexisNexis aren’t parties. Its “Vehicle” definition leaves out fleet, rental, business, and government vehicles. And for the data that already left the building, the strongest thing the order does is Provision VIII.A:

Request from Third Parties with whom Respondents shared Covered Driver Data to Delete such data, except when subject to legal or regulatory requirements (including litigation holds)

Request. GM has to ask. The data has usually already moved.

Minnesota’s privacy act reaches the car company. It mostly ducks the two that cost you money.

The Minnesota Consumer Data Privacy Act took effect July 31, 2025, sixteen months after GM says it stopped feeding the reporting agencies. I covered the Act’s structure at Minnesota’s Consumer Data Privacy Act. Three pieces matter for your car.

Your car’s location is sensitive data under Minnesota law. The Act defines “specific geolocation data” as coordinates “with an accuracy of more than three decimal degrees of latitude and longitude”. The FTC says GM’s were built for six. Not close. Specific geolocation data is one of the Act’s categories of sensitive data, § 325M.11(v)(4), and except as the Act otherwise provides, a covered controller “may not process sensitive data concerning a consumer without obtaining the consumer’s consent”. § 325M.16, subd. 2(d).

You can make the car company tell you where the data went. Against a covered controller, you can ask to delete your data and opt out of its sale, § 325M.14, subd. 1(d) and (f). The one I’d use first is the right “to obtain a list of the specific third parties to which the controller has disclosed the consumer’s personal data.” § 325M.14, subd. 1(h). If the data already moved, that list tells you where to send the next letter. One catch: a controller that doesn’t keep the list consumer by consumer can hand over its list for all consumers instead.

Nobody but the Attorney General can sue under it. The Act says it creates no private right of action, § 325M.20(d). Enforcement is an Attorney General action with an injunction and a civil penalty of up to $7,500 per violation, § 325M.20(b)–(c). The FCC location-data fines against the phone carriers taught the same lesson: the regulator gets the money, and you get the right to complain.

Now the fine print. Section 325M.12, subdivision 2, lists what the Act doesn’t cover, and two items on that list sit exactly where telematics turns into a price. Clause (8) excludes the activity of a consumer reporting agency, a furnisher, and a user of consumer reports, but only “to the extent” the activity is subject to the Fair Credit Reporting Act and handled as that Act authorizes. Clause (14) excludes personal data collected, processed, sold, or disclosed under the Minnesota Insurance Fair Information Reporting Act, with no compliance condition attached at all. The company that writes the report and the company that prices your policy? Largely handed off to other laws.

And those other laws are better at this job. Minnesota has three privacy regimes stacked on top of each other, and knowing which one applies is most of the fight.

The 1989 insurance law almost nobody talks about does the heavy lifting

Minnesota Statutes §§ 72A.49 to 72A.505, the Minnesota Insurance Fair Information Reporting Act, were enacted in 1989. Long before cars had modems, the Act described what happened to those drivers almost exactly.

The key definition is “adverse underwriting decision”, and it includes:

(5) charging a higher rate on the basis of information that differs from that which the applicant or policyholder furnished for property or casualty coverage;

You told your insurer who drives the car and how far. A reporting agency told it how hard you brake. The definition covers individually underwritten coverage, and on a policy like that, a rate that went up on the second set of facts fits it.

Once there’s an adverse underwriting decision, § 72A.499, subd. 1(a), requires the insurer or agent responsible to give you, in writing, “the specific reason or reasons for the adverse underwriting decision,” along with either the specific items of personal information behind those reasons and their sources, or notice that you can get them on request.

Under the Fair Credit Reporting Act, an insurer that takes adverse action based on a consumer report has to tell you which agency supplied it, plus “a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken”. 15 U.S.C. § 1681m(a)(3)(B). So the notice names the agency, then says the agency can’t explain the decision. Helpful. Federal law makes the insurer tell you who. Minnesota makes the insurer tell you why.

Then there’s access. Under § 72A.497, subd. 1, after a written request with proper identification, an insurer, insurance agent, or insurance-support organization has 30 business days to tell you the nature and substance of the personal information it holds, let you see and copy it, send you a copy by mail, and identify everyone it disclosed the information to within two years before your request. Asking because of an adverse underwriting decision? Subdivision 4 says it’s free. Section 72A.498 gives you a correction right on the same 30-business-day clock, and if the company won’t fix it, you’re entitled to file your own statement of what’s correct.

And the old law has what the new one doesn’t: a private remedy. Section 72A.503 makes a violator “liable to the aggrieved person for that violation to the same extent as civil remedies are otherwise allowed in section 13.08, subdivision 1”, and lets a court grant equitable and declaratory relief. The way I read that cross-reference, it borrows the Data Practices Act’s remedy: damages, costs, and reasonable attorney fees, plus exemplary damages of not less than $1,000 nor more than $15,000 for each willful violation. The privacy act gives the Attorney General a club. The 1989 law gives you one.

Which law reaches which company

One catch on the reporting-agency row. The file-disclosure statute says nothing in it requires an agency to disclose “credit scores or any other risk scores or predictors relating to the consumer.” 15 U.S.C. § 1681g(a)(1)(B). You can get the events. You may not get the score they turned into. One more reason the Minnesota insurer-side right to “the specific reason or reasons” matters. And if you find an event in the file that never happened, that’s a dispute, and it plays out the way I described in what to do when a credit-report error won’t get fixed.

The crash recorder is yours. The modem is a different story.

The event data recorder is the crash recorder, and federal law already says who owns its data. The Driver Privacy Act of 2015 provides that EDR data “is the property of the owner, or, in the case of a leased vehicle, the lessee”, and limits who else can pull it.

The consent exception is a doozy. Someone other than the owner can retrieve the data if the owner consents, including “by agreeing to a subscription that describes how data will be retrieved and used”. § 24302(b)(2). Click through the connected-services subscription and you may have handed over the crash data and the commute.

The Driver Privacy Act borrows its definition from a federal regulation, which describes a device that records data “during the time period just prior to a crash event” or during one, “intended for retrieval after the crash event.” As I read it, a feed that sends the automaker your location every three seconds isn’t that. Minnesota’s tried a crash-recorder law before. Bills in 2014 (S.F. 2038), 2015 (S.F. 1094), and 2017 (H.F. 1199) would have written owner-data rules into state law. Each one was referred to committee, and that’s where it stopped. The section the 2017 bill would have created, § 325E.595, doesn’t exist.

When police want location data, Minnesota’s tracking-warrant statute is its own fight, and I covered it at the Chatrie geofence decision. Your motor vehicle record at the state has its own federal law too, under which a court “may award” at least “liquidated damages in the amount of $2,500”, 18 U.S.C. § 2724(b)(1), and I wrote about that statute and its clock. Neither one governs what your car’s maker does with what the car sends it.

So what does a Minnesota driver actually get?

Not a time machine. Data that left your car years ago may already have been sold, scored, and priced, and nothing I’ve described here makes every company that touched it give it back. The FTC’s best tool for that was a request letter.

What you get is a paper trail. You can ask the car company where the data went. You can ask the reporting agency what’s in your file and who pulled it. And if your rate went up, you can make your insurer put the reason in writing. That last right is the oldest of the bunch, and unlike the privacy act, it comes with a private remedy.

Your car was taking notes. Minnesota law lets you read them, if you ask the right company.

Madgett Law, LLC

Madgett Law, LLC represents people whose identities were stolen or whose data was exposed, and handles credit-report disputes under the Fair Credit Reporting Act through our Credit File Corrections practice. We also advise businesses on privacy compliance. You can read more on our Identity Theft & Data Protection page. If an adverse action notice or a rate increase you can’t explain is sitting on your desk, call me at 612-470-6529 or send us a message.

Sources: In re General Motors LLC, FTC Docket No. C-4828, Complaint ¶¶ 28, 30, 38–48 (allegations; respondents neither admitted nor denied), and Decision and Order (issued Jan. 13, 2026), Definitions E and K and Provisions I, II, VI, VII, VIII.A, IX, and XVI; FTC press releases of Jan. 16, 2025 (proposed order) and Jan. 14, 2026 (final order). Letter from Sens. Ron Wyden and Edward J. Markey to FTC Chair Lina M. Khan (July 26, 2024), at 3 (Honda and Hyundai figures). Minn. Stat. § 325M.11(v)(4), (w) (sensitive data; specific geolocation data); § 325M.12, subd. 2(a), cls. (8) (FCRA exclusion “to the extent”) and (14) (Insurance Fair Information Reporting Act exclusion); § 325M.14, subd. 1(d), (f), (h) (deletion, opt-out, list of specific third parties); § 325M.16, subd. 2(d) (consent for sensitive data); § 325M.20(b)–(d) (Attorney General enforcement; $7,500 per violation; no private right of action); Laws 2024, ch. 121, art. 5, § 14 (effective July 31, 2025). Minn. Stat. § 72A.49 (short title; 1989 c 316); § 72A.491, subd. 2(5) (adverse underwriting decision); § 72A.497, subds. 1, 4 (access within 30 business days; two-year recipient list; free after an adverse decision); § 72A.498, subds. 1, 3 (correction; statement of disagreement); § 72A.499, subd. 1(a) (specific reasons in writing); § 72A.503, subds. 1–2 (private remedies); § 13.08, subd. 1 (damages, costs, attorney fees; exemplary damages of $1,000 to $15,000 per willful violation). 15 U.S.C. § 1681g(a)(1)–(3) (file disclosure; risk-score carve-out in (a)(1)(B)); 15 U.S.C. § 1681m(a)(3)(B) (adverse-action statement). Driver Privacy Act of 2015, Pub. L. No. 114-94, div. B, tit. XXIV, § 24302(a), (b)(2), 129 Stat. 1712 (49 U.S.C. § 30101 note); 49 C.F.R. § 563.5(b) (definition of event data recorder). 18 U.S.C. § 2724(b)(1) (Driver’s Privacy Protection Act liquidated damages). Minnesota Legislature bill status, S.F. 2038 (2014), S.F. 1094 (2015), H.F. 1199 (2017). This article is general commentary on Minnesota and federal law and a published federal agency order. It is not legal advice, it does not create an attorney–client relationship, and no particular outcome is promised or implied.