Your Driving Habits Are Being Sold: How Location Data Brokers Turn Your GPS Trail Into an Insurance Risk Score
Most people think about GPS tracking in pretty simple terms: your phone knows where you are, your navigation app uses that information to give you directions, and that's the end of it. Maybe you've glanced at a privacy policy once or twice and figured it was fine.
It's not quite that simple. Behind the apps you use every day, there's an entire industry built around capturing, aggregating, and reselling your location data — and some of its biggest customers are insurance companies trying to figure out how risky you are behind the wheel.
The Data Broker Ecosystem Most People Have Never Heard Of
Data brokers are companies whose entire business model is buying and selling information about people. Some of the big names — Acxiom, LexisNexis, Verisk — have been around for decades. But the location data segment of this industry is newer, faster-moving, and significantly less regulated.
Here's how the pipeline typically works. You download a free app — a weather app, a gas price tracker, a navigation tool, a coupon app. You grant it location permissions. The app collects your GPS coordinates over time, often continuously in the background. That data gets packaged and sold to a data broker, who aggregates it with location trails from dozens or hundreds of other apps. The broker then builds detailed movement profiles and sells access to those profiles to third-party clients.
Those clients include advertisers, retailers, hedge funds, and increasingly, insurance companies.
A 2023 investigation by The New York Times and subsequent reporting from consumer advocacy groups revealed just how granular this data can get. We're not talking about rough neighborhood-level location. We're talking about precise GPS coordinates, timestamped and sequential — enough to reconstruct a complete picture of where you drive, when you drive, how often you stop, what time you leave for work, and whether you tend to be out late on weekends.
"Anonymized" Is Doing a Lot of Heavy Lifting Here
The standard defense from both apps and data brokers is that the location data they collect and sell is anonymized — stripped of names, phone numbers, and other directly identifying information. Technically, that's often true. Practically, it's almost meaningless.
Researchers at MIT demonstrated years ago that just four location data points are enough to uniquely identify 95% of individuals in a large dataset. Your GPS trail is essentially a fingerprint. It starts at your home every morning. It ends there every night. It stops at your gym, your office, your kids' school, your doctor's office. You don't need a name attached to that data to know exactly whose it is.
This process — taking nominally anonymous location data and matching it back to a specific individual — is called re-identification. It's not illegal. It's not even particularly difficult with the right tools. And it's exactly what sophisticated data buyers are doing with the location trails they purchase.
What Insurers Are Actually Doing With This Information
Auto insurance has always been a data-intensive business. Insurers want to know how likely you are to file a claim, and they've traditionally used factors like your age, driving history, credit score, and vehicle type to estimate that risk. Telematics programs — where you voluntarily plug a device into your car or use an insurer's app — have expanded that picture by capturing actual driving behavior.
But third-party location data goes further, and it operates without the consumer's explicit knowledge or consent in the way telematics programs require.
Insurers working with data brokers can potentially infer things like: how often you drive late at night, whether you frequent high-accident-rate roads, how many miles you typically log per week, and whether your driving patterns suggest commuting through high-crime areas. Some brokers market products specifically designed to help insurers assess risk based on mobility data.
Verisk, one of the largest data analytics companies serving the insurance industry, has faced scrutiny for its data practices. The company's marketing materials have explicitly described using location data to help insurers better understand customer behavior — language that drew significant attention from privacy advocates and journalists.
The practical consequence for consumers: your premium could theoretically be influenced by data collected from an app you downloaded years ago and forgot about, from a source you never connected to your insurance company.
Employers Are in the Mix Too
Insurance companies aren't the only buyers worth worrying about. Employers, particularly those managing large fleets or remote workforces, have shown interest in location-based behavior data. Gig economy platforms have faced lawsuits and regulatory scrutiny over how they use driver location data. And in some industries, background check companies have begun incorporating mobility data into screening products.
The point isn't to suggest that every employer or insurer is actively doing something nefarious. The point is that data collected for one purpose — helping you find the nearest gas station — has a commercial life far beyond that original transaction, and most people have no visibility into where it ends up.
The Regulatory Picture in the US
If you're hoping federal law has this covered, you'll be disappointed. The US has no comprehensive federal privacy law governing location data. The FTC has taken enforcement actions against specific bad actors, and the FCC has fined mobile carriers for selling real-time location data to aggregators. But there's no broad statutory framework that gives consumers clear rights over their GPS data.
Some states are moving faster than the federal government. California's CPRA gives residents the right to opt out of the sale of their personal information, which includes location data. Virginia, Colorado, and Connecticut have passed similar laws. But enforcement is patchy, and the opt-out mechanisms can be deliberately difficult to find and use.
Practical Steps to Limit Your Exposure
You can't opt out of the entire data economy, but you can meaningfully reduce your footprint. Here's where to start.
Audit your location permissions right now. On both iPhone and Android, you can see exactly which apps have location access and at what level. For most apps — especially ones you don't actively use for navigation — there's no reason they need "always on" location access. Downgrade them to "while using" or revoke permissions entirely.
Be skeptical of free apps that request location. If a flashlight app wants to know where you are, that should raise a flag. Location data is often how free apps monetize their user base. If you're not paying for the product, your location might be.
Use a VPN cautiously. A VPN can obscure your IP address but doesn't prevent app-level location data collection. Don't rely on it as a complete privacy solution.
Consider a dedicated navigation device. A standalone GPS unit that isn't connected to an app ecosystem doesn't have the same data collection infrastructure as a smartphone app. It's a more privacy-preserving option for people who are genuinely concerned.
Read opt-out options seriously. Major data brokers like Acxiom and Oracle Data Cloud offer opt-out mechanisms. They're not always easy to find, but they exist. Spending an hour working through them is worth it.
Check your state's privacy rights. If you're in California, Virginia, Colorado, or another state with a comprehensive privacy law, you have specific rights to request data deletion and opt out of sales. Use them.
Your Data, Your Move
The location data economy didn't emerge from malicious intent. It grew out of a combination of technical capability, business incentives, and regulatory gaps — the usual recipe. But the result is a system where your daily movements are being turned into a commercial asset without your meaningful awareness or consent.
Knowing that is the first step. Adjusting your app permissions, understanding your state's privacy rights, and thinking critically about which apps actually need to know where you are — that's how you start navigating this landscape on your own terms.
Your GPS is a tool. Make sure it's working for you, not for someone else's spreadsheet.