OnStar Lawsuit: FTC Order, $12.75M California Deal, Class Action

The OnStar lawsuit is really a cluster of legal actions accusing General Motors and its OnStar subsidiary of secretly collecting detailed driving data from millions of vehicles and selling it to data brokers, who then sold it to auto insurance companies that used it to raise premiums or drop coverage. As of 2026, the fallout includes a finalized Federal Trade Commission consent order, a record $12.75 million California penalty, at least five state attorney general cases, and a consolidated federal class action covering roughly 16 million drivers.1Law360. GM Must Face MDL Wiretap Claims Over OnStar Devices

What GM and OnStar Were Accused of Doing

GM vehicles built from roughly 2015 onward operated as sensor platforms. Through OnStar’s connected-services system and a feature called Smart Driver, cars collected acceleration, braking force, speed, distance, seatbelt use, trip start and end times, and precise GPS location, sometimes as often as every three seconds.2FTC. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data Smart Driver was pitched to consumers as a way to earn “digital badges” for safe driving and reduce wear on the vehicle.3The Indiana Lawyer. State Sues General Motors, OnStar, Claiming Deceptive Practices

Behind the scenes, GM transmitted that data to two brokers, LexisNexis Risk Solutions and Verisk Analytics, which turned it into risk scores and driver-rating products sold to auto insurers.4New York Times. Carmakers Driver Tracking Insurance Insurers then used those profiles to set premiums, deny coverage, or cancel policies. Drivers were not told.2FTC. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data

Enrollment is central to every case. The FTC called the sign-up process “confusing and misleading.” Customers were pushed to enroll in OnStar at the dealership as an emergency and roadside service, and Smart Driver was often bundled in without clear disclosure of what it did with the data.2FTC. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data Some customers said they were enrolled without their knowledge at all. A GM sales training manual showed that salespeople could earn bonuses for OnStar sign-ups. The terms and conditions mentioned “third parties” in general terms but did not spell out that data would be sold to insurance-industry brokers.5Capital One. Why General Motors Dropped Its OnStar Smart Driver Program Beginning in 2022, GM made a three-year OnStar and Connected Services plan standard on GMC and Buick vehicles, removing the choice for those buyers.6LawCommentary. GM Hit With Second Lawsuit Over Sharing Customer Data That Led to Higher Insurance Rates

After a March 2024 New York Times investigation, GM cut ties with LexisNexis and Verisk on March 20, 2024, and announced on April 24, 2024 that Smart Driver was being discontinued and all enrolled customers would be removed from the program.7Ars Technica. GM Stops Sharing Driver Data With Brokers Amid Backlash8GM. OnStar Smart Driver Program Announcement At its peak, about eight million OnStar customers had been enrolled.5Capital One. Why General Motors Dropped Its OnStar Smart Driver Program

How Drivers Found Out

Most drivers only learned about the arrangement when their insurance rates climbed. Romeo Chicco, a Florida driver who became a lead plaintiff, said his rates “nearly doubled.” When he contacted Liberty Mutual, he was told the increase came from a LexisNexis report detailing 258 trips in his Cadillac, including acceleration events, hard braking, and high-speed incidents.6LawCommentary. GM Hit With Second Lawsuit Over Sharing Customer Data That Led to Higher Insurance Rates Another driver’s LexisNexis disclosure report ran 130 pages and covered 640 trips over six months.4New York Times. Carmakers Driver Tracking Insurance

One consumer’s complaint to GM, quoted by the FTC, put it plainly: “When I signed up for this, it was so OnStar could track me. They said nothing about reporting it to a third party. Nothing. … You guys are affecting our bottom line. I pay you, now you’re making me pay more to my insurance company.”2FTC. FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data

The Federal Class Action

Dozens of individual and class-action complaints have been consolidated into a single multidistrict proceeding, In re: Consumer Vehicle Driving Data Tracking Litigation, MDL No. 3115, in the U.S. District Court for the Northern District of Georgia, before Senior Judge Thomas Thrash. The transfer order centralizing the cases was issued on June 6, 2024.9AboutLawsuits. GM OnStar Lawsuit The consolidated litigation names GM, OnStar, LexisNexis Risk Solutions, and Verisk Analytics as defendants and covers a proposed nationwide class of roughly 16 million drivers.1Law360. GM Must Face MDL Wiretap Claims Over OnStar Devices

On April 22, 2026, Judge Thrash largely denied the defendants’ motion to dismiss. The order preserved the wiretapping allegations at the heart of the suit and let claims under the Federal Wiretap Act, the Stored Communications Act, the Fair Credit Reporting Act, and common-law theories of unjust enrichment, invasion of privacy, and civil conspiracy move forward.10DiCello Levitt. Court Allows GM OnStar Vehicle Data Privacy Lawsuit to Move Forward The judge narrowed some claims, but the core case survived.1Law360. GM Must Face MDL Wiretap Claims Over OnStar Devices As of mid-2026, the court has not yet certified a class, and no settlement or judgment has been reached. This is the case most likely to result in payments to individual drivers if it succeeds.

The FTC Consent Order

The Federal Trade Commission announced its complaint and proposed consent order against General Motors LLC, General Motors Holdings LLC, and OnStar LLC on January 16, 2025. The complaint alleged two counts under Section 5 of the FTC Act, covering unfair and deceptive practices for collecting and selling precise geolocation and driving behavior data without informed, affirmative consent.11Federal Register. General Motors and OnStar LLC Analysis of Proposed Consent Order

The commission finalized the order on January 14, 2026. Its provisions run for 20 years and include:12FTC. FTC Finalizes Order Settling Allegations GM OnStar Collected Sold Geolocation Data Without Consumers’ Consent

  • A five-year ban on disclosing geolocation and driving behavior data to consumer reporting agencies.
  • A requirement to obtain clear, unambiguous permission, separate from general terms of service, before collecting, using, or sharing connected vehicle data, with limited exceptions such as providing location data to emergency responders.
  • Publication of a data retention schedule, deletion of previously collected driving data unless legally required to keep it or the consumer provides new consent, and instructions to third parties that received the data to delete it.
  • Consumer tools to request copies of their data, request deletion, disable precise geolocation collection, and opt out of data collection entirely.
  • A ban on dark patterns, including inferring consent from silence or penalizing consumers who decline to consent.

The order did not include a monetary penalty and does not pay drivers directly.12FTC. FTC Finalizes Order Settling Allegations GM OnStar Collected Sold Geolocation Data Without Consumers’ Consent

California’s $12.75 Million Settlement

On May 8, 2026, California Attorney General Rob Bonta, joined by the District Attorneys of San Francisco, Los Angeles, Napa, and Sonoma counties and the California Privacy Protection Agency, announced a $12.75 million settlement with GM. It is the largest penalty ever imposed under the California Consumer Privacy Act.13California Attorney General. When It Comes to Data Privacy, Consumers Must Be in the Driver’s Seat The action alleged that from 2020 to 2024, GM sold the names, contact information, geolocation, and driving behavior of hundreds of thousands of Californians to LexisNexis and Verisk without consent, and falsely stated in its privacy policy that it did not sell such data. California estimated GM earned about $20 million from those sales.14CalMatters. GM Record California Penalty OnStar Data

Under the settlement, which remains subject to court approval, GM must delete retained driving data within 180 days (with limited internal-use exceptions), ask LexisNexis and Verisk to delete previously shared data, and submit ongoing privacy assessments to state regulators. A five-year ban on selling driving data to consumer reporting agencies mirrors the FTC order.13California Attorney General. When It Comes to Data Privacy, Consumers Must Be in the Driver’s Seat The money goes to the state, not directly to individual drivers.

State Attorney General Cases

At least five state attorneys general have brought their own actions, each under state consumer protection statutes, each seeking civil penalties and injunctive relief, and in some cases restitution for consumers.

Whether the federal Fair Credit Reporting Act preempts these state consumer protection statutes has not yet been resolved and is being tested in the Indiana case.

What Current and Former GM Owners Can Do Now

If you drive or drove a GM vehicle from 2015 onward, there are a few practical steps worth taking while the litigation plays out.

Request your file from the data brokers. LexisNexis Risk Solutions and Verisk are the two companies that received the driving data. A consumer disclosure report will show whether trips from your vehicle were logged and, if so, what was recorded.

Check your auto insurance history. If your premium rose or a policy was non-renewed between roughly 2020 and 2024, ask your insurer whether a third-party driving-behavior report factored into the decision. That is the paper trail plaintiffs in the class action have relied on.

Watch the class action. The MDL in the Northern District of Georgia is the proceeding most likely to produce direct payments to individual drivers. A class has not yet been certified, so no claim form exists. Notice, if one is ordered, would go to affected owners at that point.

Exercise the rights the FTC order requires. GM is now required to let you request copies of your data, ask for deletion, disable precise geolocation collection, and opt out of data collection. These rights apply going forward under the 20-year order and do not depend on any lawsuit.12FTC. FTC Finalizes Order Settling Allegations GM OnStar Collected Sold Geolocation Data Without Consumers’ Consent