Many General Motors customers enrolled in OnStar connected services while registering a vehicle at a dealership, often without understanding that they were agreeing to the collection of driving data. The Federal Trade Commission says that information could include speeding habits, night-driving patterns and precise location records collected as often as every three seconds.
The agency finalised a consent order against General Motors and OnStar on 14 January 2026, voting 2-0 to bar the company for five years from selling customer data to consumer reporting agencies and third-party data brokers.
The order follows a 2024 investigation by The New York Times into GM’s collection and sale of driving data through OnStar. Some drivers told the newspaper that their insurance rates rose after the data was collected. The FTC said it found in 2025 that GM had failed to warn customers that their information would be transferred to third parties, particularly LexisNexis.
GM shared data with LexisNexis and Verisk, two brokers that work with insurers to build risk profiles, according to the FTC. The company collected information about how customers drove, including the frequency of speeding and the timing of journeys such as night driving, alongside precise geolocation data.
The five-year restriction is limited to sales to consumer reporting agencies and third-party data brokers. Its wider obligations last for twenty years. Throughout that period, GM must obtain clear, affirmative consent before collecting, using or sharing connected-vehicle data.
Every US consumer must be able to ask GM for a copy of their data and request that it be deleted. They must also be able to disable precise geolocation collection where their vehicle’s technology permits, and opt out entirely of geolocation and driver-behaviour collection. GM must delete or destroy previously retained covered driver data within 180 days of the order taking effect. The agreement provides a narrow exception for transmitting location data to emergency first responders.
The FTC settlement carries no monetary penalty and creates no consumer redress fund. Drivers whose insurance premiums increased as a result of data sold by GM will receive no compensation through the federal order. Breaches of the finalised order can lead to civil penalties of up to $51,744 per violation.
California regulators subsequently reached their own settlement with GM. On 8 May 2026, the California Attorney General, several county district attorneys and the California Privacy Protection Agency announced a $12.75 million agreement with the company. The penalty is the largest to date under the California Consumer Privacy Act.
California alleged that GM collected driving-behaviour and precise geolocation data through OnStar from 2020 to 2024, then sold it to Verisk Analytics and LexisNexis Risk Solutions. The data was used in driver-rating products marketed to insurers, regulators said. They also said GM generated roughly $20 million from the sales.
That allegation sat uneasily with GM’s own privacy policy, which stated that the company did not sell driving or location data. The California settlement and the FTC order put GM’s data practices under scrutiny from more than one set of regulators, while leaving several practical questions unresolved. It is unknown whether other automakers used similar arrangements, whether the brokers will successfully delete GM data previously sold under California settlement terms, or how compliance with the federal order will be monitored.
The scale of consumer use of the new rights is also unclear. Customers can seek access to their records, ask for deletion and opt out of collection, yet there is no indication of how many will do so. The status and timetable of federal multidistrict litigation, MDL No. 3115, in Georgia, and a separate pending lawsuit in Texas are also unknown.
Comments (0)