General Motors and OnStar have accepted a Federal Trade Commission settlement over driver data sales that bans them from sharing consumers’ geolocation and driving behavior data with consumer reporting agencies for five years and requires affirmative consumer consent for connected vehicle data practices for the next twenty. The FTC finalized the consent order on January 14, 2026, by a 2-0 Commission vote. It carries no monetary penalty, but it does give drivers the right to see, delete, and stop the collection of the data GM’s cars have been sending back.
What GM Was Doing With Driver Data
Through OnStar and a feature called Smart Driver, GM collected precise location data from Chevrolet, GMC, Cadillac, and Buick vehicles as often as every three seconds for some drivers, along with records of hard braking, speeding, and late-night driving. GM then sold that information to consumer reporting agencies. The FTC did not name the buyers in its complaint, but separate reporting and state cases identified LexisNexis Risk Solutions and Verisk Analytics as the two main recipients. Insurers pulled reports from those agencies to set premiums or deny coverage.
The FTC called the enrollment process “confusing and misleading.” Consumers were pitched Smart Driver as a way to review their own driving habits, often during the vehicle purchase, without a clear explanation that granular trip data would end up with outside companies. Some drivers did not know they had been enrolled at all. Over time GM expanded what Smart Driver collected to include precise geolocation without giving updated notice.
The practical effect on individual drivers was steep. A driver profiled in a March 2024 New York Times investigation obtained a LexisNexis report containing 130 pages of trip-level data covering 640 trips over six months, and eight insurers had requested his information in a single month. Another consumer saw her insurance premiums rise 80 percent after 603 entries of her driving data were shared with brokers. According to the California Attorney General, GM earned roughly $20 million nationwide from selling driver data to LexisNexis and Verisk between 2020 and 2024.
GM stopped sharing driving behavior data with LexisNexis and Verisk on March 22, 2024, eleven days after the Times investigation ran, and discontinued Smart Driver in April 2024. The FTC’s proposed order followed in January 2025 and was finalized a year later.
What the FTC Order Requires
The order names General Motors LLC, General Motors Holdings LLC, and OnStar, LLC as respondents. It runs for twenty years and imposes the following obligations:
- Five-year data-sharing ban. GM and OnStar cannot disclose consumers’ geolocation or driver behavior data to consumer reporting agencies for five years.
- Affirmative express consent. For the full twenty-year life of the order, GM must obtain clear, affirmative consent before collecting, using, or sharing connected vehicle data. A narrow exception allows transmitting location data to emergency first responders.
- Consumer data rights. Every U.S. consumer must be able to request a copy of their data, request its deletion, disable precise geolocation collection where the vehicle’s technology allows, and opt out of geolocation and driver behavior collection entirely.
- Deletion of past data. Within 180 days of the order taking effect, GM must delete or destroy previously retained covered driver data, with limited carve-outs for active litigation holds, legal requirements, and product safety investigations. GM must also instruct third parties that previously received data to delete it, and cannot share further data with those parties until deletion is confirmed.
- Data minimization and retention schedule. Collection must be limited to what is reasonably necessary for specific stated purposes, and GM must create and follow a formal retention schedule.
- Compliance monitoring. GM must file an initial compliance report within one year. The FTC may request additional reports, interview company personnel, and pose as consumers to test compliance without prior notice.
The case docket is C-4828 (FTC File No. 242 3052). Violations of the finalized order can trigger civil penalties of up to $51,744 per violation.
What GM Drivers Can Do Now
If you own or lease a GM vehicle equipped with OnStar, the consent order gives you four concrete rights you can exercise directly with the company: ask for a copy of the connected vehicle data GM holds about you, ask GM to delete it, turn off precise geolocation collection if your vehicle’s hardware and software support that, and opt out of geolocation and driver behavior collection altogether. These rights apply for the full twenty-year term of the order.
If a consumer reporting agency, most likely LexisNexis Risk Solutions or Verisk Analytics, built a driving report on you using GM data, the order requires GM to instruct those third parties to delete what they received. That does not automatically clean up a report an insurer already pulled and priced against, so requesting your own file from the reporting agencies directly, and disputing entries, remains a separate step the FTC order does not perform for you.
What the Order Does Not Do
The FTC settlement contains no monetary penalty and no consumer redress fund. Drivers who paid higher premiums because of data GM sold do not receive compensation through this order. If you are looking for financial recovery, that is happening on other tracks.
The order also does not resolve state-law claims or private lawsuits. Those remain open, and one of them may cover you.
Other Cases That May Affect You
California reached a separate settlement with GM on May 8, 2026, imposing $12.75 million in civil penalties, the largest under the California Consumer Privacy Act to that point. The enforcement was brought by Attorney General Rob Bonta, the California Privacy Protection Agency, and the district attorneys of San Francisco, Los Angeles, Napa, and Sonoma counties. California alleged CCPA violations, unfair competition, and false advertising, and described the case as the first enforcement of the CCPA’s data minimization principle. GM must delete retained driving data within 180 days, direct LexisNexis and Verisk to delete previously received data, stop selling driving data to consumer reporting agencies for five years, and stand up a privacy compliance program with annual reporting. The settlement was subject to court approval as of May 2026.
Three state attorneys general have active lawsuits. Texas AG Ken Paxton sued GM and OnStar in August 2024 over data collected from more than 1.5 million Texans, alleging violations of the Texas Deceptive Trade Practices Act. Arkansas AG Tim Griffin filed on February 26, 2025, under the Arkansas Deceptive Trade Practices Act and unjust enrichment. Nebraska AG Mike Hilgers filed on July 8, 2025, in Lancaster County District Court under the Nebraska Consumer Protection Act and the Uniform Deceptive Trade Practices Act, seeking civil penalties of $2,000 per violation plus restitution, and alleging that GM incentivized dealership employees to enroll customers without proper disclosure. All three remained active in mid-2026.
A consolidated private class action, In re: Consumer Vehicle Driving Data Tracking Collection Litigation (MDL No. 3115), is proceeding before U.S. District Judge Thomas Thrash in the Northern District of Georgia. It names GM, OnStar, LexisNexis Risk Solutions, and Verisk Analytics as defendants on behalf of a proposed nationwide class of approximately 16 million drivers. On April 22, 2026, Judge Thrash largely denied the defendants’ motion to dismiss, allowing claims under the Federal Wiretap Act, the Stored Communications Act, the Fair Credit Reporting Act, and theories of unjust enrichment, invasion of privacy, and civil conspiracy to move forward. If you drove a covered GM vehicle with OnStar during the affected years, the MDL is the vehicle most likely to produce monetary recovery for individual drivers.