Your Car Has Been Reporting On You. The Company Buying The Data Also Sells It To The Police.

Your Car Has Been Reporting On You. The Company Buying The Data Also Sells It To The Police. General Motors sold your driving behavior to LexisNexis without telling you. LexisNexis sells investigative intelligence to the DOJ, ICE, and hundreds of law enforcement agencies. In November 2026 every new car in America gets a mandatory monitoring camera. There is no law governing what happens to the data it generates. THE SENTINEL | [email protected]

In December 2016, General Motors entered into a contract with a data broker called Verisk Analytics. Under that contract, GM began transmitting personally identifiable information from customers enrolled in its OnStar Smart Driver program to Verisk, which compiled the information and sold it to auto insurance companies. The information transmitted included names, addresses, vehicle identification numbers, trip data, hard braking events, acceleration records, and instances of driving over 80 miles per hour. Nearly three years later GM entered into a nearly identical contract with a second data broker called LexisNexis Risk Solutions, adding timestamps and seatbelt usage data to the package. This continued for years. The customers whose data was being sold were not told. Many did not know they were enrolled in Smart Driver at all. Some had been signed up by dealerships during the purchase process without understanding what the enrollment meant. Others had actively declined OnStar service but found their driving data in LexisNexis consumer reports anyway. Insurance rates went up. Customers had no explanation. One driver saw an 80 percent premium increase traced to hundreds of driving records her GM vehicle had generated and transmitted without her knowledge. In March 2024, the New York Times published the story. GM discontinued Smart Driver the following month. In January 2026, the Federal Trade Commission finalized a consent order describing GM's conduct as an egregious betrayal of consumers' trust, banning the company from selling sensitive driver and geolocation data to data brokers for five years and requiring explicit affirmative consent before any data collection going forward. The story as it was reported focused on GM. The story as it actually exists is considerably larger.

THE COMPANY NOBODY IS TALKING ABOUT LexisNexis Risk Solutions is not a household name. It operates in the infrastructure layer underneath transactions you do make — the insurance quote, the background check, the police investigation — aggregating data from thousands of sources and selling access to it under contract. LexisNexis markets itself to law enforcement as a provider of investigative intelligence, offering what it describes as contextualized insights using robust identity data, contributory law enforcement data, automated link analysis technology, and advanced analytics designed to speed investigations and solve more crimes. Its flagship law enforcement product, called Accurint Virtual Crime Center, brings together data from over 10,000 different sources — including police agencies nationwide — into a single platform that allows investigators to locate suspects, retrieve jail booking photographs, perform link analysis, map crime patterns, and conduct cross-jurisdictional identity searches. The United States Department of Justice awarded LexisNexis a contract to provide the Accurint Virtual Crime Center platform across five federal agencies. The company also holds contracts with ICE, the Secret Service, and hundreds of state and local law enforcement agencies across the country. This is the same company that was simultaneously buying driving behavior data from GM and selling it to insurance companies. The same LexisNexis that compiled driving records on millions of Americans without their knowledge also sells identity data, location data, and investigative intelligence tools to law enforcement at every level of the federal government. That is not a coincidence. That is a business model.

WHAT THE FTC FOUND The Federal Trade Commission's investigation produced a documented record of how the collection actually worked. In December 2016 GM began selling personally identifiable information to Verisk under a Telematics Data Exchange Program. The data included names, addresses, persistent vehicle identifiers, trip mileage, hard braking, acceleration, and records of when a driver traveled over 80 miles per hour. Nearly three years later GM entered into a similar contract with LexisNexis adding timestamps and seatbelt usage. Until 2023, GM told consumers who did not consent to data collection that they would have to accept limited functionality. Consumers who tried to reject OnStar terms saw a message telling them their decision to decline would result in deactivation of all services including Automatic Crash Response, Emergency Services, and Vehicle Diagnostics. Consent obtained by threatening to disable your crash response system is not consent. The FTC agreed. In some cases drivers experienced significant insurance rate increases without being told the source. One driver reported an 80 percent premium increase after hundreds of driving records from her GM vehicle were shared with insurers without her knowledge. The FTC alleged that GM and OnStar used a misleading enrollment process to obtain participation in the program. The company is now banned from selling that category of data for five years. The five year clock runs out. After that, no current law prevents the practice from resuming unless Congress acts. Congress has not acted.

THE WARRANT QUESTION NOBODY IS ASKING LexisNexis's law enforcement products aggregate data from over 10,000 sources. That data includes public records, law enforcement agency-contributed data, location information, identity records, and until the FTC consent order put a five-year stop to it, driving behavior data purchased from automakers. The Accurint platform allows investigators to search all of it simultaneously from a single interface. The data flowing into that platform does not all carry the same legal protections. Information purchased from data brokers does not require a warrant to access because it was not obtained through government action. It was purchased from a private company that obtained it through consumer contracts, many of which, as the GM investigation documented, were agreed to through enrollment processes the FTC described as misleading. When a law enforcement agency uses Accurint to pull a comprehensive profile of an individual — location history, driving behavior, identity records, associates, addresses — they may be accessing information that required no warrant, no court order, and no probable cause determination at any step in the chain from collection to delivery. The private company collected it. The broker aggregated it. The agency purchased access. The constitutional protections that would apply if the government had collected the same information directly are not triggered because a private company did the collecting first. LexisNexis Risk Solutions holds a contract with ICE's Homeland Security Investigations agency providing access to its database of personal information that includes data authorized under the Drivers Privacy Protection Act. The Drivers Privacy Protection Act governs driver's license information — the same information that sits in PennDOT's database, that JNET searches with facial recognition, and that AAMVA aggregates in the national S2S system underlying REAL ID. These are not separate pipelines. They draw from overlapping sources and feed into overlapping customers.

THE 2026 MANDATE AND WHAT COMES AFTER Section 24220 of the 2021 Infrastructure Investment and Jobs Act directs the National Highway Traffic Safety Administration to mandate advanced impaired driving prevention technology in all new passenger vehicles. Under the mandate automakers can choose from a range of technologies including driver-facing cameras tracking eye movement and head position, software analyzing steering and lane-keeping behavior, or touch-based alcohol sensors embedded in the steering wheel or start button. In January 2026 an amendment offered by Representative Thomas Massie of Kentucky to block funding for NHTSA's implementation was defeated in the House. The mandate is moving forward. Compliance is required for vehicles manufactured from November 2026 onward. The stated purpose is preventing drunk driving deaths. Mothers Against Drunk Driving supports the mandate and the problem it addresses is real. Drunk driving kills tens of thousands of Americans every year and the people who die in those crashes did not consent to the risk. What is also real is the infrastructure context in which this mandate arrives. The federal government is requiring that every new passenger vehicle sold in America be equipped with a passive monitoring system that watches the driver's eyes and behavior at a moment when the documented history of automotive data shows that manufacturers sold driver behavior data to brokers for years without meaningful consumer knowledge, when the FTC consent order governing GM's conduct expires in five years with no permanent law replacing it, and when the company that bought that driving data from GM simultaneously sells investigative intelligence to law enforcement at every level of the federal government. There is no federal data protection law governing what an automaker does with the biometric data generated by a driver-facing impairment detection camera. There is no law prohibiting the sale of that data to LexisNexis or any other broker. There is no law requiring that a warrant be obtained before law enforcement accesses driving behavior data purchased through the broker ecosystem. The rulemaking defining the technical standards for the 2026 mandate is still in progress. The data governance question has not been answered in that rulemaking. When one customer called OnStar to cancel the Smart Driver service after learning about the data sales, the OnStar agent told him that even if he turned it off they could still track him and still see what he was doing. The agent ended the call by saying she hoped he would not find himself in a situation where he needed them and they were not there. That conversation happened while the program was running, while the data was being sold, while insurance rates were going up for people who had no idea why. The 2026 mandate puts a camera in every new car in America. The company that bought the last generation of driving behavior data sells investigative intelligence to the federal government. There is no federal law closing the gap between those two facts.

WHAT IS DOCUMENTED The GM OnStar data sale to LexisNexis and Verisk is documented in the FTC consent order finalized in January 2026 and in the consolidated class action litigation in the Northern District of Georgia. The FTC's finding of an egregious betrayal of consumers' trust is in the public record. LexisNexis Risk Solutions' law enforcement contracts including its DOJ contract and its ICE contract are documented through federal contract databases and published press releases. The Accurint Virtual Crime Center product and its aggregation of data from over 10,000 sources is described in LexisNexis's own marketing materials. Section 24220 of the Infrastructure Investment and Jobs Act is public law. The January 2026 defeat of Representative Massie's amendment is in the Congressional record. The absence of a federal data protection law governing automotive biometric data is verifiable through the Congressional legislative record. A company that bought driving behavior data on millions of Americans without their meaningful consent and sold it to insurance companies also sells investigative intelligence tools aggregating data from over 10,000 sources to law enforcement agencies at every level of the federal government. In November 2026 federal law requires that a monitoring system be installed in every new passenger vehicle sold in the United States. There is no law governing what happens to the data that system generates. That is the documented situation.

The Sentinel — Montgomery County Pennsylvania.

There is no safety in surveillance.