[biggripper]

I read this article this morning and I found it alarming. I know I've read many reports here on the forums of other members seeing steep rate increases with insurance. I don't know what data, if any, BMW shares with insurance companies or third-party data brokers like LexisNexis. Obviously, people will tend to drive safer if they know they are being tracked. My discomfort lies with auto manufacturers being less than 100% transparent with their data-sharing practices. Imagine seeing your rates skyrocket for no explainable reason or worse finding yourself almost un-insurable as was the case for one of the gentlemen in the article.

I'm curious to here other members thoughts. I'm also curious to know if anyone has any better information on whether BMW currently shares data with insurance companies or third-party data brokers.

Automakers Are Sharing Consumers’ Driving Behavior With Insurance Companies
LexisNexis, which generates consumer risk profiles for the insurers, knew about every trip G.M. drivers had taken in their cars, including when they sped, braked too hard or accelerated rapidly.
• Published March 11, 2024Updated March 13, 2024
Kenn Dahl says he has always been a careful driver. The owner of a software company near Seattle, he drives a leased Chevrolet Bolt. He’s never been responsible for an accident.
So Mr. Dahl, 65, was surprised in 2022 when the cost of his car insurance jumped by 21 percent. Quotes from other insurance companies were also high. One insurance agent told him his LexisNexis report was a factor.
LexisNexis is a New York-based global data broker with a “Risk Solutions” division that caters to the auto insurance industry and has traditionally kept tabs on car accidents and tickets. Upon Mr. Dahl’s request, LexisNexis sent him a 258-page “consumer disclosure report,” which it must provide per the Fair Credit Reporting Act.
What it contained stunned him: more than 130 pages detailing each time he or his wife had driven the Bolt over the previous six months. It included the dates of 640 trips, their start and end times, the distance driven and an accounting of any speeding, hard braking or sharp accelerations. The only thing it didn’t have is where they had driven the car.

On a Thursday morning in June for example, the car had been driven 7.33 miles in 18 minutes; there had been two rapid accelerations and two incidents of hard braking.
According to the report, the trip details had been provided by General Motors — the manufacturer of the Chevy Bolt. LexisNexis analyzed that driving data to create a risk score “for insurers to use as one factor of many to create more personalized insurance coverage,” according to a LexisNexis spokesman, Dean Carney. Eight insurance companies had requested information about Mr. Dahl from LexisNexis over the previous month.
“It felt like a betrayal,” Mr. Dahl said. “They’re taking information that I didn’t realize was going to be shared and screwing with our insurance.”

In recent years, insurance companies have offered incentives to people who install dongles in their cars or download smartphone apps that monitor their driving, including how much they drive, how fast they take corners, how hard they hit the brakes and whether they speed. But “drivers are historically reluctant to participate in these programs,” as Ford Motor put it in a patent application that describes what is happening instead: Car companies are collecting information directly from internet-connected vehicles for use by the insurance industry.
Sometimes this is happening with a driver’s awareness and consent. Car companies have established relationships with insurance companies, so that if drivers want to sign up for what’s called usage-based insurance — where rates are set based on monitoring of their driving habits — it’s easy to collect that data wirelessly from their cars.
But in other instances, something much sneakier has happened. Modern cars are internet-enabled, allowing access to services like navigation, roadside assistance and car apps that drivers can connect to their vehicles to locate them or unlock them remotely. In recent years, automakers, including G.M., Honda, Kia and Hyundai, have started offering optional features in their connected-car apps that rate people’s driving. Some drivers may not realize that, if they turn on these features, the car companies then give information about how they drive to data brokers like LexisNexis.
Automakers and data brokers that have partnered to collect detailed driving data from millions of Americans say they have drivers’ permission to do so. But the existence of these partnerships is nearly invisible to drivers, whose consent is obtained in fine print and murky privacy policies that few read.
Especially troubling is that some drivers with vehicles made by G.M. say they were tracked even when they did not turn on the feature — called OnStar Smart Driver — and that their insurance rates went up as a result.
“GM’s OnStar Smart Driver service is optional to customers,” a G.M. spokeswoman, Malorie Lucich, said. “Customer benefits include learning more about their safe driving behaviors or vehicle performance that, with their consent, may be used to obtain insurance quotes. Customers can also unenroll from Smart Driver at any time.”
Even for those who opt in, the risks are far from clear. I have a G.M. car, a Chevrolet. I went through the enrollment process for Smart Driver; there was no warning or prominent disclosure that any third party would get access to my driving data.
“I am surprised,” said Frank Pasquale, a law professor at Cornell University. “Because it’s not within the reasonable expectation of the average consumer, it should certainly be an industry practice to prominently disclose that is happening.”
Policymakers have expressed concern about the collection of sensitive information from consumers’ cars. California’s privacy regulator is currently investigating automakers’ data collection practices. Last month, Senator Edward Markey of Massachusetts also urged the Federal Trade Commission to investigate.
“The ‘internet of things’ is really intruding into the lives of all Americans,” Senator Markey said in an interview. “If there is now a collusion between automakers and insurance companies using data collected from an unknowing car owner that then raises their insurance rates, that’s, from my perspective, a potential per se violation of Section 5 of the Federal Trade Commission Act.”
That is the federal law that prohibits unfair and deceptive business practices that harm consumers.
‘Smart Driver’
Mr. Dahl shared his experience on an online forum for Chevy Bolt enthusiasts, on a thread where other people expressed shock to find that LexisNexis had their driving data. Warnings about the tracking are scattered across online discussion boards dedicated to vehicles manufactured by G.M. — including Corvettes, a sports car designed for racking up “acceleration events.” (One driver lamented having data collected during a “track day,” while testing out the Corvette’s limits on a professional racetrack.)
Numerous people on the forums complained about spiking premiums as a result. A Cadillac driver in Palm Beach County, Fla., who asked not to be named because he is considering a lawsuit against G.M., said he was denied auto insurance by seven companies in December. When he asked an agent why, she advised him to pull his LexisNexis report. He discovered six months of his driving activity, including many instances of hard braking and hard accelerating, as well as some speeding.
“I don’t know the definition of hard brake. My passenger’s head isn’t hitting the dash,” he said. “Same with acceleration. I’m not peeling out. I’m not sure how the car defines that. I don’t feel I’m driving aggressively or dangerously.”
When he finally obtained car insurance, through a private broker, it was double what he had previously been paying.
The Cadillac owner, Mr. Dahl and the drivers on the forums had all been enrolled in OnStar Smart Driver. OnStar is G.M.’s Internet-connected service for its cars and Smart Driver is a free, gamified feature within G.M.’s connected car apps (all part of OnStar, but branded MyChevrolet, MyBuick, MyGMC and MyCadillac).
Smart Driver can “help you become a better driver,” according to a corporate website, by tracking and rating seatbelt use and driving habits. In a recent promotional campaign, an Instagram influencer used Smart Driver in a competition with her husband to find out who could collect the most digital badges, such as “brake genius” and “limit hero.”
In response to questions from The New York Times, G.M. confirmed that it shares “select insights” about hard braking, hard accelerating, speeding over 80 miles an hour and drive time of Smart Driver enrollees with LexisNexis and another data broker that works with the insurance industry called Verisk.
Customers turn on Smart Driver, said Ms. Lucich, the G.M. spokeswoman, “at the time of purchase or through their vehicle mobile app.” It is possible that G.M. drivers who insisted they didn’t opt in were unknowingly signed up at the dealership, where salespeople can receive bonuses for successful enrollment of customers in OnStar services, including Smart Driver, according to a company manual.

The Cadillac owner in Florida said he had not heard of Smart Driver and never noticed it in the MyCadillac app. He reviewed the paperwork he signed at the dealership when he bought his Cadillac in the fall of 2021 and found no mention of signing up for it.
“When a customer accepts the user terms and privacy statement (which are separately reviewed in the enrollment flow), they consent to sharing their data with third parties,” Ms. Lucich wrote in an email, pointing to OnStar’s privacy statement.
But that statement’s section on “third-party business relationships” does not mention Smart Driver. It names SiriusXM as a company G.M. might share data with, not LexisNexis Risk Solutions, which G.M. has partnered with since 2019.
Jen Caltrider, a researcher at Mozilla who reviewed the privacy policies for more than 25 car brands last year, said that drivers have little idea about what they are consenting to when it comes to data collection. She said it is “impossible for consumers to try and understand” the legalese-filled policies for car companies, their connected services and their apps. She called cars “a privacy nightmare.”
“The car companies are really good at trying to link these features to safety and say they are all about safety,” Ms. Caltrider said. “They’re about making money.”
Neither the car companies nor the data brokers deny that they are engaged in this practice, though automakers say the main purpose of their driver feedback programs is to help people develop safer driving habits.
After LexisNexis and Verisk get data from consumers’ cars, they sell information about how people are driving to insurance companies. To access it, the insurance companies must get consent from the drivers — say, when they go out shopping for car insurance and sign off on boilerplate language that gives insurance companies the right to pull third-party reports. (Insurance companies commonly ask for access to a consumer’s credit or risk reports, though they are barred from doing so in California, Massachusetts, Michigan and Hawaii.)
An employee familiar with G.M.’s Smart Driver said the company’s annual revenue from the program is in the low millions of dollars.
LexisNexis Risk Solutions, which retains consumers’ driving data for six months, has “strict privacy and security policies designed to ensure that data is not accessed or used impermissibly,” the company said in a statement.
Verisk provides insurers with trip data and a risk score “approved by insurance regulators in 46 states and the District of Columbia,” said a spokeswoman, Amy Ebenstein. Automakers that Verisk gets data from “provide their customers notice and obtain appropriate consents,” she said.
Some drivers who had Smart Driver turned on, though, said they did not even realize they were enrolled until they saw warnings on online forums and then checked their app. They quickly unenrolled themselves by turning off Smart Driver in their car app.
Omri Ben-Shahar, a law professor at the University of Chicago, said he was in favor of usage-based insurance — where insurers monitor mileage and driving habits to determine premiums — because people who are knowingly monitored are better drivers. “People drive differently,” he said. “The impact on safety is enormous.”
But he was troubled, he said, by “stealth enrollment” in programs with “surprising and potentially injurious” data collection. There is no public safety benefit if people don’t know that how they drive will affect how much they pay for insurance.
‘Real-World Driving Behavior’
General Motors is not the only automaker sharing driving behavior. Kia, Subaru and Mitsubishi also contribute to the LexisNexis “Telematics Exchange,” a “portal for sharing consumer-approved connected car data with insurers.” As of 2022, the exchange, according to a LexisNexis news release, has “real-world driving behavior” collected “from over 10 million vehicles.”
Verisk also claims to have access to data from millions of vehicles and partnerships with major automakers, including Ford, Honda and Hyundai.
Two of these automakers said they were not sharing data or only limited data. Subaru shares odometer data with LexisNexis for Subaru customers who turn on Starlink and authorize that data be shared “when shopping for auto insurance,” said a spokesman, Dominick Infante.
Ford “does not transmit any connected vehicle data to either partner,” said a spokesman, Alan Hall, but partnered with them “to explore ways to support customers” who want to take part in usage-based insurance programs. Ford will share driving behavior from a car directly with an insurance company, he said, when a customer gives explicit consent via an in-vehicle touch screen.
The other automakers all have optional driver-coaching features in their apps — Kia, Mitsubishi and Hyundai have “Driving Score,” while Honda and Acurahave “Driver Feedback” — that, when turned on, collect information about people’s mileage, speed, braking and acceleration that is then shared with LexisNexis or Verisk, the companies said in response to questions from The New York Times.
But that would not be evident or obvious to drivers using these features. In fact, before a Honda owner activates Driver Feedback, a screen titled “Respect for your Privacy” assures drivers that “your data will never be shared without your consent.” But it is shared — with Verisk, a fact disclosed in a more than 2,000-word “terms and conditions” screen that a driver needs to click “accept” on. (Honda does mention Verisk in an FAQ on its website and Kia highlights its relationship with LexisNexis Risk Solutions on its website. A Kia spokesman said LexisNexis can’t share driving score data of Kia participants with insurers without additional consent.)
Drivers who have realized what is happening are not happy. The Palm Beach Cadillac owner said he would never buy another car from G.M. He is planning to sell his Cadillac.


How to Find Out What Your Car Is Doing
• See the data your car is capable of collecting with this tool: https://vehicleprivacyreport.com/.
• Check your connected car app, if you use one, to see if you are enrolled in one of these programs.
• Do an online search for “privacy request form” alongside the name of your vehicle’s manufacturer. There should be instructions on how to request information your car company has about you.
• Request your LexisNexis report: https://consumer.risk.lexisnexis.com/consumer
• Request your Verisk report: https://fcra.verisk.com/#/

[kjx]

Even if BMW may have nothing to do with this, I’m glad I go out of my way to disenroll from third-party sharing where allowed.

What I hadn’t done, but will do now, is to also turn off non-required usage analysis in iDrive.

[biggripper]

Originally Posted by kjx

Even if BMW may have nothing to do with this, I’m glad I go out of my way to disenroll from third-party sharing where allowed.

What I hadn’t done, but will do now, is to also turn off non-required usage analysis in iDrive.

I guess what I’m unsure of also it which services I can disenroll from and not kill some of the things that I like.

[geko29]

Here are a couple of statements from BMW on the topic:

Third parties can access selected telematics data in order to offer you personalized services - provided that you explicitly direct BMW to release this data to this third party. You alone decide to whom you entrust your data. The telematics data will not be forwarded to any third parties other than those to which you have directed BMW to send data.

BMW NA does not share customer’s personal information with insurance companies without consent. Insurance carriers have been operating telematics-based insurance programs for over a decade. If BMW customers wish to share their telematics information with their insurance carriers, then that is solely based on their choice. BMW merely ensures that any such sharing of data is done in an informed, controlled, consented, and secure manner. Furthermore, BMW customers may choose to share data relating to their driving behavior with their insurance carriers (without using any BMW vehicle system or the BMW back end) simply by using their insurance carrier’s mobile app or OBD2 hardware connected insurance programs.

You can also request a report from LexisNexis of what data they have on you from here: https://consumer.risk.lexisnexis.com/consumer

[JDUNITNOW]

Ypu can also go on Lexis Nexis and block anyone from pulling your data ans from them collecting your data.

[christianb5s4]

Just did the request, full opt out and deletion of any personal data they have. And the lack of transparency or forewarning to consumers is for one reason only: they know people would reject it.

Sadly, none of this surprises me.

[SwankPeRFection]

This is why you go into Privacy Settings and make sure all that shit if off. If/when something was to surface that points back to you or is even anonymized, it’s just a lawsuit away. One reason I hate connected vehicles and go out of my way to sever those connections if possible. No reason to have a constant cellular connection from the car to BMW corporate or whomever the manufacturer is.

[jbirb305]

Originally Posted by christianb5s4

Just did the request, full opt out and deletion of any personal data they have. And the lack of transparency or forewarning to consumers is for one reason only: they know people would reject it.

Sadly, none of this surprises me.

how did u opt out and delete the data?

[madpistol]

Welp, I know what I'm doing in my car in a bit. I thought we were just sharing our data with BMW. I did not know they were sharing/selling that data to insurance companies.

Great job, BMW. That's disgusting.

[biggripper]

Originally Posted by madpistol

Welp, I know what I'm doing in my car in a bit. I thought we were just sharing our data with BMW. I did not know they were sharing/selling that data to insurance companies.

Great job, BMW. That's disgusting.

Are they? I don’t know. That’s my concern. I’m not accusing them of doing so but I’m afraid that could be happening. Certainly other manufacturers are engaged in this. Last thing I’d want is to end up like the dude that was denied insurance for his Cadillac by 7 different companies.

[McLaren720s]

Has anyone found anything in the Data Privacy menu in iDrive that would explicitly state they're sharing driving habits with other companies? I'm not really seeing anything like that but I still don't trust them...could be somewhere written in fine text and intentionally not very obvious

[/ / / M3]

Originally Posted by biggripper

Are they? I don’t know. That’s my concern. I’m not accusing them of doing so but I’m afraid that could be happening. Certainly other manufacturers are engaged in this. Last thing I’d want is to end up like the dude that was denied insurance for his Cadillac by 7 different companies.

“With regard to Mozilla’s warning to drivers that ‘you might not want your insurance company to know about your lead foot…. except, there’s a pretty high likelihood they already do,’ BMW NA operates a permission and consent-based CarData program that is available to each customer on their My Garage feature within BMWusa.com. Each BMW customer can specifically select any business partner with whom they would like to share data from their vehicles and can revoke these permissions at any time. BMW NA does not share customer’s personal information with insurance companies without consent.”

https://www.repairerdrivennews.com/2...y-accusations/

So it looks like they DO share data with insurance companies. What's less clear is whether data sharing is enabled by default via My Garage. The My Garage feature does't work for me (the garage shows as empty and does not recognize my VIN number - possibly because I am in Canada). Can someone check this?

[JDUNITNOW]

Originally Posted by jbirb305

how did u opt out and delete the data?

Go on their website and their is a opt out section if I'm not mistaken. There are multiple agencies that pull your info. I opted out mistaken of them except the big three. I can't remember the other ones but when I worked in banking, we used Lexis Nexis for mortgage loans to gather info missed by the big three to underwrite loans.

[biggripper]

Originally Posted by / / / M3

“With regard to Mozilla’s warning to drivers that ‘you might not want your insurance company to know about your lead foot…. except, there’s a pretty high likelihood they already do,’ BMW NA operates a permission and consent-based CarData program that is available to each customer on their My Garage feature within BMWusa.com. Each BMW customer can specifically select any business partner with whom they would like to share data from their vehicles and can revoke these permissions at any time. BMW NA does not share customer’s personal information with insurance companies without consent.”

https://www.repairerdrivennews.com/2...y-accusations/

So it looks like they DO share data with insurance companies. What's less clear is whether data sharing is enabled by default via My Garage. The My Garage feature does't work for me (the garage shows as empty and does not recognize my VIN number - possibly because I am in Canada). Can someone check this?

Thanks for this link. It was pretty helpful. Particularly this quote:

BMW NA operates a permission and consent-based CarData program that is available to each customer on their My Garage feature within BMWusa.com. Each BMW customer can specifically select any business partner with whom they would like to share data from their vehicles and can revoke these permissions at any time. BMW NA does not share customer’s personal information with insurance companies without consent.”

[Bimmerfun82]

Getting denied insurance based on acceleration and braking in a corvette is insanity.

Never buying a GM vehicle again. This is unbelievable.

I remember when State Farm was offering to put devices in our cars to “save us money.” Yeah… no

[biggripper]

Originally Posted by Bimmerfun82

Getting denied insurance based on acceleration and braking in a corvette is insanity.

Never buying a GM vehicle again. This is unbelievable.

I remember when State Farm was offering to put devices in our cars to “save us money.” Yeah… no

Exactly! Screw GMs money grab. While I’d never choose to use an insurance company facilitated OBD tool, at least that is a mostly transparent program versus some shady shit backdoored into your life because you didn’t read 25 plus pages of fine print that only a lawyer could understand.

[Bimmerfun82]

Originally Posted by biggripper

Exactly! Screw GMs money grab. While I’d never choose to use an insurance company facilitated OBD tool, at least that is a mostly transparent program versus some shady shit backdoored into your life because you didn’t read 25 plus pages of fine print that only a lawyer could understand.

It's pretty ironic to me that Tesla has its own insurance arm in several states, and Tesla knows EXACTLY how you drive. And they say they can lower your rates. It's not available in my state, but I would consider it on our Tesla. In the meantime, I've checked the BMW Data Report T&C's again and it looks very straightforward. Just in case, I ran a data transaction report, and no data has been requested or shared with a 3rd party.

"Top 10 Data access by third parties
No data access requests were made by third parties for your vehicle during the defined period, nor were any data on events provided.
List of data retrievals
No data access requests were made by third parties for your vehicle during the defined period, nor were any data on events provided.
Provided services
No services were provided for your vehicle by independent providers within the specified time period."

[McLaren720s]

Can’t wait to be “convicted” based on something I haven’t done yet. Just because I accelerate or brake more or less, doesn’t mean I’ll cause a collision or crash. It’s actually often that slow, clueless, distracted and oblivious drivers that cause collisions.

[wasya152]

Originally Posted by geko29

Here are a couple of statements from BMW on the topic:





You can also request a report from LexisNexis of what data they have on you from here: https://consumer.risk.lexisnexis.com/consumer

Can someone who knows post how to opt out and/or post a link to how to do so?

[McLaren720s]

Originally Posted by wasya152

Can someone who knows post how to opt out and/or post a link to how to do so?

It looks to me that is only applicable to residents of California, Connecticut, Colorado, New Jersey, Nevada, Utah, or Virginia.

You can see it here:
https://consumer.risk.lexisnexis.com/

The rest of us are SOL, as far as I can tell

[wasya152]

Originally Posted by McLaren720s

It looks to me that is only applicable to residents of California, Connecticut, Colorado, New Jersey, Nevada, Utah, or Virginia.

You can see it here:
https://consumer.risk.lexisnexis.com/

The rest of us are SOL, as far as I can tell

There was a an opt out link/request but it seems to take to report page.

Do Not Sell or Share My Personal Information opens this link
https://consumer.risk.lexisnexis.com/request

[Needsdecaf]

Originally Posted by Bimmerfun82

It's pretty ironic to me that Tesla has its own insurance arm in several states, and Tesla knows EXACTLY how you drive. And they say they can lower your rates. It's not available in my state, but I would consider it on our Tesla. In the meantime, I've checked the BMW Data Report T&C's again and it looks very straightforward. Just in case, I ran a data transaction report, and no data has been requested or shared with a 3rd party.

"Top 10 Data access by third parties
No data access requests were made by third parties for your vehicle during the defined period, nor were any data on events provided.
List of data retrievals
No data access requests were made by third parties for your vehicle during the defined period, nor were any data on events provided.
Provided services
No services were provided for your vehicle by independent providers within the specified time period."

How did you run this report?