The U.S. government has barred General Motors and its OnStar subsidiary from sharing detailed driver data with insurance companies, closing out a federal investigation into how the automaker collected and sold that information.
What GM Was Actually Doing
The Federal Trade Commission finalized an order concluding that GM secretly gathered precise location and driving-behavior data from more than one million vehicles, in some cases recording activity every few seconds. That data captured things like hard braking, rapid acceleration, speeds exceeding 80 miles per hour, and late-night driving patterns. Regulators say GM then sold that information to third-party brokers, including LexisNexis and Verisk, which packaged it into driver reports that insurers used to assess risk and set premiums.
Drivers Paid the Price Without Knowing Why
The consequences landed directly on drivers’ wallets. In some cases, people saw significant insurance rate hikes with no explanation of where the underlying data came from — one driver reported an 80 percent premium increase after hundreds of her driving records were shared with insurers. Regulators found that a large share of affected drivers didn’t even realize their vehicles were enrolled in the OnStar Smart Driver program in the first place, let alone that their habits behind the wheel were being sold to third parties.
Which Vehicles Were Involved
Vehicles sold under the Chevrolet, Buick, GMC, and Cadillac brands since 2016 may have been swept up in the program. The FTC determined that the sign-up process itself was misleading and failed to clearly spell out how driving data would be collected or used. GM ultimately shut down the Smart Driver program in April 2024, after media reporting brought the practice into public view.
What the Settlement Actually Requires
Under the terms of the settlement, GM and OnStar are barred for five years from sharing geolocation and driver-behavior data with consumer reporting agencies. For the following 20 years, both companies must obtain explicit consent before collecting or sharing any connected-vehicle data at all. GM is also required to delete previously collected data, give consumers access to their own records on request, and offer an option to fully disable location tracking. Notably, no financial penalties were imposed as part of the order.
Consumers can request access to, or deletion of, their data through GM’s privacy request process or by phone, and drivers can also request copies of any files LexisNexis or Verisk have on them directly.
The FTC settlement itself doesn’t include compensation for affected drivers, but multiple class action lawsuits tied to the same practices are still working their way through the courts, with litigation expected to continue for years.