Insurers have a lot of data about us. Where do they get it, and how do they use it?

How much does your insurer really know about you? It could be more than just what’s on your application form for the policy.

Insurers have long been allowed to use what they know about us to charge different prices for the same level of cover, albeit within some tight rules.

Recent media coverage about how Australian insurers set their premiums has shone a spotlight on just how much unconventional data may factor into this equation.

It has also raised concerns about the possible risks of discrimination as insurers gain access to more and more detailed data, increasingly drawing on external sources and artificial intelligence (AI). It’s worth understanding where this information comes from and how it is allowed to be used.

What data do insurers have and where does it come from?

When you apply for an insurance quote, you disclose personal and policy details that vary by cover type. These can range from details about your age and health to driving history or property information.

Publicly available information, such as Census data, adds to this picture.

Insurers also have access to your claims history. Some can also draw on behavioural and relationship data, such as payment frequency, policy duration, and likelihood of switching.

The world of big data

Then there’s big data, and the third-party firms able to turn this information into products that can be marketed to insurance companies.

Sometimes, these products are produced through sophisticated analysis of public data to produce usable insights. For example, in the United Kingdom, a tool from data analytics firm Verisk called Resonate groups neighbourhoods using data on household composition, education, court judgements and affluence.

But other data firms can aggregate and analyse vast amounts of non-traditional data points, such as web browsing activity, social media footprint, and more.

Australia’s Privacy Act regulates the buying, selling or sharing of our personal data, generally requiring our consent or another recognised basis. So if this data does make its way to insurance companies, it’s often in a de-identified or aggregated form.

But there are still risks. A 2024 report by the Australian Competition and Consumer Commission raised concerns that even when personal information has been de-identified, it could still be re-identified in the future when combined with other information.

The commission also raised concerns about consumers being targeted based on shared traits – a practice researchers call “affinity profiling”.

Examples of what can go wrong

Recent controversies in the United States illustrate the importance of protecting our data, as the digital footprint of our daily life continues to grow.

In 2025, the US Federal Trade Commission (FTC) took action against General Motors, alleging the company sold information about drivers’ behaviour (such as the amount of hard braking) and location to third parties, without adequate consent.

According to a 2024 investigation by The New York Times, some of this data made its way to insurance companies.

In a settlement with the FTC earlier this year, General Motors was banned from sharing this data with consumer reporting agencies for five years, and now requires explicit consent for broader data sharing for the next 20 years.

Charging different people different prices

In Australia, there are federal anti-discrimination laws covering age, disability, sex and race. However, three of these acts – those covering age, disability and sex – give insurance companies an exemption.

These exemptions let insurers charge different people different prices or refuse to offer a product based on “actuarial or statistical data on which it is reasonable to rely” to assess different levels of risk.

Guidance from the Human Rights Commission and Actuaries Institute cautions it may not be reasonable to rely on data that is:

out-of-date, qualified, incomplete, discredited, based on an insufficient sample size, or not directly applicable to the particular situation.

Some data is completely off-limits. The Racial Discrimination Act covers race, colour, descent, national or ethnic origin, and immigrant status, with no exemption for these grounds.

State and territory laws also apply and may protect a wider range of attributes, including religious belief.

Genetic testing has long fallen under the exemption too. However, a ban on insurers using adverse genetic results starts in October, after sustained advocacy.

What are the risks?

This shift toward more data and automation raises several risks. One is proxy (or indirect) discrimination. This is where a neutral-looking factor such as credit score can be associated with a protected attribute, such as race.

Guidance from the Human Rights Commission and Actuaries Institute warns removing a protected attribute from a dataset is not sufficient, as other data may still act as a proxy.

Using AI for insurance underwriting and pricing does not change the fundamental risks of proxy discrimination. But legal scholars have raised concerns it could make them more severe and harder to detect.

The right to an explanation

For consumers, the importance of transparency and “explainability” is what ties this all together. Insurance is built on trust, with customers pooling risk with insurers whose pricing decisions they cannot easily verify.

Australia’s Privacy Act requires organisations to manage personal information in an open and transparent way. Despite this, a 2026 ASIC review of five motor vehicle insurance providers found none had explained in their quote and renewal documents:

the key factors that affected the calculation of the premium, or why the premium had changed from the previous year.

New data and AI bring real opportunities for sharper risk assessment and products that reward healthy behaviour. But we can’t lose sight of some real risks – including unfair, opaque pricing and the erosion of privacy.

Fei Huang has received research funding from the Australian Research Council through the Discovery Program, the Society of Actuaries, and the Casualty Actuarial Society. She has also undertaken contract research with AMP. She is affiliated with UNSW Sydney and is an affiliated member of the Actuaries Institute.