A hot potato: Many were surprised to learn that connected vehicles collect data about drivers and sell that information to insurance companies. As it turns out, so do apps on a driver's smartphone. Most drivers are unaware that this is even happening.

Earlier this year, the New York Times dropped a bomb on drivers of connected vehicles: manufacturers collect and sell their driving data to insurance companies, which use the information to set rates for individual drivers. Now, a new report shows that this type of data collection is more ubiquitous than even dystopian-minded privacy advocates might have realized.

Information about driving habits is also being collected by apps that are only tangentially related to automobiles. You may already have one installed on your phone.

Examples include Life360, MyRadar, and GasBuddy. They all have opt-in driving analysis features that rely on sensor and motion data from the phone. The apps also offer insights into things like safety and fuel usage. Many of these apps partner with a company called Arity, a data broker founded by Allstate.

Arity uses the data it collects to create driving scores and then sells them to auto insurance companies, which use the data to set rates for drivers using the apps. Arity claims it has over 40 million "active connections" to US drivers, who have opted into sharing their driving data through "consumer mobile apps, in-car devices, and connected cars."

While users must consent to the data collection, the request for the data is often hidden in boilerplate contract language that most smartphone users don't read. The apps also make it difficult to see in the apps' opt-in process.

For example, GasBuddy has a feature that rates the fuel efficiency of trips. It is "powered by Arity," but the agreement to opt into the data collection is in a small gray font under a big red button labeled "Join Drives." Furthermore, the disclosure only informs the driver that by clicking "Join Drives" they will share "certain information" with Arity and agree to its hyperlinked privacy statement.

The apps essentially double dip on their users, first by charging them a subscription fee, then by selling their driving data to car insurance companies. Consumers know about the cost of the subscription. However, most are unaware of how much information the data brokers collect and how much that data may cost them in their insurance rates.

If you don't like the idea of your car insurance company spying on your driving habits, you should avoid apps powered by Arity or all driving-related apps altogether.