What we found
Progressive Snapshot: FProgressive says: let us watch you drive, and we might lower your rate.
Snapshot monitors hard braking, rapid acceleration, speed, time of driving (late-night driving is penalised), and total mileage. While marketed as a way to earn discounts, the data can also increase premiums. Drivers who discover their behaviour doesn't qualify for discounts can't un-share the data. Progressive shares driving data with LexisNexis -- one of the largest data brokers -- creating a permanent driving risk profile that other insurers can access. Even if you leave Progressive, the LexisNexis record follows you. Driving data can be subpoenaed in accident lawsuits, potentially used against you in court. The "discount programme" is a one-way surveillance door: you share data hoping for savings, but the data persists in broker databases whether you save money or not. You can't un-ring the surveillance bell.
Root Insurance App: CRoot exposed 72,852 peoples drivers license numbers in plaintext.
New York AG Letitia James fined Root $975,000 after their online quoting tool exposed full plaintext drivers license numbers in generated PDFs. 72,852 people were impacted. Automated bots exploited the vulnerability to harvest 44,449 New Yorkers license numbers. The stolen data was used to file fraudulent unemployment claims during COVID-19. Root failed to perform risk assessments, did not identify plaintext exposure, and lacked controls against automated attacks.
AAMI Driver Rewards: CAAMI turned safe driving into a game so you would hand over your driving data for free.
Suncorp explicitly stated the program is designed to "poach the best clients" from other insurers by gathering richer behavioural data. The app is open to non-AAMI customers specifically to harvest driving profiles that identify low-risk drivers sitting on competitors books. 480 million kilometres of driving data collected and analysed.
NRMA Safety Hub: BNRMA says you opted in.
The NRMA Insurance app runs in the background and automatically records trips when your smartphone detects motion that signifies a drive. It monitors GPS location, accelerometer data, speed, braking, cornering, and whether you touch your phone screen while in motion. Opting out requires not just toggling the app setting but also manually changing Location Services AND Physical Activity permissions in device settings.