Montana Attorney General Austin Knudsen on April 8, 2026, issued what the state describes as its first civil investigative demands against two major automotive manufacturers - Ford Motor Company and Stellantis N.V. - over the collection and sale of personal driving data to third-party companies. The demands, issued under the Montana Unfair Trade Practices and Consumer Protection Act, mark a significant escalation in state-level scrutiny of connected vehicle data practices and add a new jurisdiction to an already crowded regulatory landscape facing the automotive industry.

The documents, nine pages in total for the Ford demand alone, were sent from the Montana Department of Justice, Office of Consumer Protection, to Ford Motor Company's commercial registered agent, CT Corporation System, at 3011 American Way in Missoula, Montana. The deputy solicitor general who signed both demands is Brent Mead, reachable at [email protected]. Ford has until 5:00 p.m. MDT on May 8, 2026, to respond.

What the demands cover

The scope of information sought is broad. According to the investigative demand for Ford, the state is commanding the company to produce documents covering four categories of data: Driving Data, Personal Information, Connected Vehicle Data, and Telematics Data. Each term is defined with legal precision. "Connected Vehicle Data," for instance, means "all information or data generated by or collected from a vehicle, vehicle systems, sensors, telematics control units, embedded modems, infotainment systems, or companion applications." That definition encompasses data collected about both the vehicle and the person driving it, "regardless of whether de-identified or anonymized."

The demand defines "Telematics Data" specifically as connected vehicle data used to "infer or score driving behavior." That framing is significant - it brings into scope the raw sensor outputs that underpin usage-based insurance (UBI) programs, where insurers set premiums based on how a driver accelerates, brakes, or corners. The demand also defines "UBI" as any insurance program that uses driving behavior, including telematics data, to set, adjust, or offer rates or discounts, or that is reviewed at the underwriting stage.

Two companies appear by name as subjects of specific inquiries: LexisNexis and Verisk. LexisNexis is defined in the demand as LexisNexis Risk Solutions and its affiliates, including the LexisNexis Telematics Exchange. Verisk is defined as Verisk Analytics, Inc., and its affiliates, including any and all platforms used to integrate and/or analyze Ford's data. The demand asks Ford to identify the starting and ending dates of its agreements with each entity, the total revenue received from LexisNexis, and all consideration received from Verisk. It is asking Ford to account, specifically, for all money generated through data-sharing relationships.

28 specific demands

The investigative demand breaks down into 28 discrete requests, spanning document production, factual responses, and sworn verification. Ford is required to detail, with particularity, its entire data flow for driving data and connected vehicle information - including categories collected, purposes, retention periods, and access rights. The state wants to know every product, service, or platform through which Ford collects the relevant categories of data.

The relevant time period specified in the demand is April 1, 2021 through the present. That five-year window covers the period during which public reporting and regulatory attention on automotive data monetization intensified significantly.

Several of the 28 requests target specific statements Ford has apparently made in public or to regulators. The demand asks Ford to "produce Documents sufficient to support the statement that 'Ford does not sell any connected vehicle data to data brokers.'" It also asks for documents supporting Ford's claim that it "made the decision last year to phase out our support of these products and focus on other priorities," and for documents supporting Ford's statement that its agreements with LexisNexis "ended without launching any products and [Ford] never shared any connected vehicle data with them." Those requests suggest the AG's office is probing whether Ford's public statements about data practices match its internal records.

Montana is also asking Ford to produce all documents it previously provided to any state attorney general's office, to the U.S. Federal Trade Commission, and to the California Privacy Protection Agency - all in connection with driving data and connected vehicle data. That cross-jurisdictional sweep gives Montana access to whatever paper trail already exists in other regulatory proceedings.

Responses must be made under oath, with one or more authorized persons completing and notarizing a verification form. According to the demand: "Your responses and document production must be made in accordance with the enclosed instructions. Your responses also must be made under oath by having one or more authorized persons complete and have notarized the verification form provided herein."

The document also carries an explicit preservation notice: "Do not destroy or otherwise lose from your possession, custody, or control any documents that may be relevant or responsive to the following demands for information or requests to produce documents. Notify the Attorney General's Office immediately of any such loss or destruction."

The demands are issued under MONT. CODE ANN. sections 30-14-113 and 30-14-114, which grant the attorney general authority to investigate potential violations of the Montana Unfair Trade Practices and Consumer Protection Act (MONT. CODE ANN. section 30-14-103 et seq.). Failure to comply can trigger penalties under section 30-14-134. The demands also contain a Fifth Amendment warning - noting that information produced may be used in civil or criminal proceedings - and reference both the U.S. Constitution and Article 2, Section 25 of the Montana Constitution.

This legal grounding matters for marketers and ad-tech professionals tracking regulatory momentum. State consumer protection statutes, not federal privacy law, are powering this action. Montana is not operating under a comprehensive state privacy law equivalent to California's CPRA - it is using a general unfair trade practices statute. That demonstrates how broadly state attorneys general can reach into data-collection practices even without dedicated data privacy legislation.

The LexisNexis and Verisk dimension

The explicit naming of LexisNexis and Verisk in the demand is notable. Both companies operate in the insurance data analytics space and have been at the center of prior reporting on how automakers share driving behavior data with insurers. LexisNexis Risk Solutions operates the Telematics Exchange, a platform through which insurance carriers can access standardized telematics scores derived from connected vehicle data. Verisk Analytics provides similar analytics infrastructure to the insurance industry.

The demand's definitions are careful to include not just raw data sharing but also "derived outputs" in the definition of third-party recipients: the demand covers "insurers, rental companies, fleet managers, mobility partners, data brokers, analytics vendors, aggregators, or other entities receiving your data or derived outputs." That framing encompasses the full chain from raw sensor data to scored behavioral profiles used in underwriting.

The demand asks Ford to identify the total revenue received from its agreement with LexisNexis and to categorize revenue by the party with which data-sharing relationships exist. It also asks whether Ford has ever sold or shared driving data, personal information, connected vehicle data, or telematics data with any third-party recipient, including data brokers and insurance companies - and to detail its opt-in process for UBI programs.

Consumer notice and opt-out obligations

One dimension the demand probes directly is what Ford told consumers. The state is demanding that Ford produce all disclosures given to customers during the April 2021-to-present period relating to the collection, storage, use, sale, and/or other dissemination of driving data and connected vehicle information. It also asks Ford to detail its policy for providing consumer notice, access, correction, and deletion - and specifically what happens to all previously shared data when a consumer opts out.

That opt-out question is particularly pointed in the context of data that has already been passed to a third-party analytics exchange. Once telematics data has been processed into an insurance score by LexisNexis or Verisk, it is not obvious that any vehicle-level opt-out undoes the downstream impact on an individual's insurance pricing profile. The demand does not resolve that question, but it is clearly probing whether Ford's stated consumer controls reflect operational reality.

Broader regulatory context

The Montana action sits within a fast-moving landscape of state and federal enforcement targeting data monetization by companies with large consumer datasets. California's DROP platform, the state-administered deletion mechanism that went live January 1, 2026, notably recorded vehicle identification numbers (VINs) in 24% of the 242,000 consumer sign-up requests in its first eight weeks - a figure disclosed at the California Privacy Protection Agency's February 27, 2026 board meeting. That statistic underlines how connected vehicle identifiers are already circulating in the data broker ecosystem.

California has moved against data brokers selling health and behavioral data, with the first enforcement action under the state's Delete Act resulting in a $45,000 fine for a Texas company that sold lists of consumers categorized by medical conditions. A California lawmaker has also introduced AB-1542, which would outright prohibit the sale or sharing of sensitive personal information - a category that includes precise geolocation and behavioral data.

The FTC has been building infrastructure of its own. Its FY 2026-2030 Strategic Plan, published April 3, 2026, explicitly elevates consumer protection enforcement and the use of the agency's Tech Lab to identify and pursue enforcement targets. The OkCupid case, in which the FTC enforced its civil investigative demand in federal court after the company initially resisted, is a recent reminder that these demands carry legal weight.

Montana's investigative demands explicitly ask Ford to produce all documents it provided to the FTC on these subjects, suggesting coordination - or at least awareness - between state and federal investigators. That cross-sharing dynamic, in which state attorneys general and the FTC mine the same corporate document productions, has become standard in major consumer data cases.

What it means for the marketing and ad-tech ecosystem

At first glance, automotive driving data may seem distant from digital advertising and programmatic media. But the connections are direct. Insurance telematics data, once aggregated and scored by platforms like the LexisNexis Telematics Exchange, can inform risk profiles that in turn affect the financial standing and purchasing behavior of millions of consumers. The data chain that begins in a Ford vehicle's telematics control unit may ultimately influence what credit products, insurance offers, and financial services a consumer sees - including through targeted digital advertising.

The demand's definition of "Third-Party Recipient" explicitly includes "data brokers, analytics vendors, aggregators" - the exact categories of companies that sit at the intersection of behavioral data and digital advertising. Data that begins as accelerometer readings in a connected car can end up as an audience segment in a programmatic campaign.

For companies that purchase audience data from intermediaries, the Montana action is a fresh reminder that regulatory attention is now tracing data flows upstream, all the way to the point of original collection. The legal theory being tested here - that collecting and selling driving behavior data without adequate consumer notice may constitute an unfair or deceptive trade practice - could apply to a wide range of data categories if the Montana investigation leads to enforcement.

Compliance teams at automotive brands, insurance carriers, and the data analytics vendors that serve them will need to track whether this investigation expands, whether other state attorneys general issue parallel demands, and whether the FTC moves on any findings shared by Montana. The five-year lookback window - April 2021 to the present - covers a period in which telematics programs scaled substantially across the industry.

Timeline

  • April 1, 2021: Relevant time period specified in the investigative demand begins.
  • January 7, 2026: California Assembly Member Christopher Ward introduces AB-1542, which would prohibit businesses from selling sensitive personal information to third parties.
  • January 8, 2026: California Privacy Protection Agency issues its first enforcement action under the Delete Act, fining Texas data broker Datamasters $45,000 for failing to register and selling health-condition lists.
  • February 27, 2026: California Privacy Protection Agency board meeting discloses that the DROP platform has registered 242,000 consumers and 575 data brokers; VINs appear in 24% of deletion requests.
  • March 30, 2026: FTC files complaint and proposed settlement against OkCupid after successfully enforcing its civil investigative demand in federal court.
  • April 3, 2026: FTC publishes its FY 2026-2030 Strategic Plan, elevating consumer data enforcement and the use of the agency's Tech Lab.
  • April 8, 2026: Montana Attorney General Austin Knudsen issues its first civil investigative demands against Ford Motor Company and Stellantis N.V. over connected vehicle data practices. The demand is signed by Deputy Solicitor General Brent Mead.
  • May 8, 2026: Ford's deadline to respond to the investigative demand, by 5:00 p.m. MDT.

Summary

Who: Montana Attorney General Austin Knudsen, acting through Deputy Solicitor General Brent Mead of the Montana Department of Justice, Office of Consumer Protection, issued civil investigative demands against Ford Motor Company and Stellantis N.V.

What: Montana's first civil investigative demands under the Montana Unfair Trade Practices and Consumer Protection Act command both automakers to produce all documents related to the collection, sale, and sharing of driving data, connected vehicle data, telematics data, and personal information. The demands name LexisNexis Risk Solutions and Verisk Analytics as specific third-party recipients of interest, and cover 28 distinct document production and factual response requests. Ford must respond by May 8, 2026.

When: The demands are dated April 8, 2026. The relevant time period covered is April 1, 2021 through the present.

Where: The demand is issued by the Montana Department of Justice, Office of Consumer Protection, 215 North Sanders Street, Helena, MT 59601. It was directed to Ford's commercial registered agent at 3011 American Way, Missoula, MT 59808.

Why: The investigation follows reports that personal driving data collected through connected vehicle systems is sold to third-party companies, including data brokers and insurance analytics providers. Montana is probing whether consumer notice, consent, and opt-out mechanisms met legal standards under state consumer protection law - and whether Ford's public statements denying data sales are supported by internal documentation.

Share this article
The link has been copied!