What General Motors (OnStar Smart Driver) does with your data

What it collects and does with your data

• The FTC alleged GM used a misleading enrollment process for OnStar and Smart Driver and sold precise geolocation and driving behavior data from millions of vehicles to third parties, including consumer reporting agencies, without informed consent.
• FTC Chair Lina Khan said GM monitored and sold precise geolocation and driver behavior information, sometimes as often as every three seconds.
• GM publicly confirmed sharing Smart Driver data with Verisk from 2015 to 2024 and with LexisNexis Risk Solutions from 2018 to 2024; GM declined to tell Senator Wyden how many cars or what it was paid. The NYT reported 8 million vehicles.
• Per the Wyden-Markey letter, GM combined the Smart Driver opt-in with consent for theft-alarm emails and safety reports, and also shared location data on all drivers who activated connectivity with an unnamed partner (Company A, which Sky News linked to Wejo) until May 2023, then with a second unnamed company. GM told staff the only opt-out was disabling the car's internet connection.
• California AG investigation: GM sold names, contact information, geolocation, and driving behavior of hundreds of thousands of Californians to Verisk and LexisNexis from 2020 to 2024 and reportedly made approximately $20 million nationwide from those sales.
• NYT investigation found GM collected driving data from millions of drivers and sold it for use in insurance pricing.
• Nebraska AG alleges dealership employees were incentivized to enroll customers without proper disclosure and in some cases without any consent.

Sensitive data

• precise geolocation (as often as every 3 seconds per FTC)
• driving behavior (hard braking, acceleration, speed, trip start/end)
• seatbelt usage (Nebraska complaint)
• names and contact information

Enforcement and litigation

5 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• FTC administrative order (20-year). Complaint announced Jan 2025; final order approved 2-0 on 2026-01-14. Five-year ban on disclosing geolocation and driver behavior data to consumer reporting agencies; affirmative express consent required. No monetary penalty. Status: final, in effect.
• California AG plus San Francisco, Los Angeles, Napa, and Sonoma DAs with CalPrivacy: CCPA and UCL settlement, largest CCPA penalty to date. Announced subject to court approval; GM's Q2 2026 10-Q reports final settlements and agreed consent orders with the FTC and California regulators during H1 2026. Amount: $12.75 million.
• Texas AG lawsuit (Montgomery County, DTPA) alleging unlawful collection and sale of over 1.5 million Texans' driving data. Status: no ruling or settlement found as of 2026-09-25; GM 10-Q says it is defending state enforcement suits.
• Nebraska AG lawsuit (Lancaster County) under the Consumer Protection Act and UDTPA. Status: pending; no resolution found.
• In re Consumer Vehicle Driving Data Tracking Litigation, MDL No. 3115 (N.D. Ga.) against GM, OnStar, LexisNexis Risk Solutions, and Verisk. On 2026-04-22 Judge Thrash largely denied motions to dismiss wiretap, Stored Communications Act, and privacy claims; 29 of 65 counts dismissed. Status: pending.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 6. Minimum count of named or described holders: GM, OnStar, Verisk, LexisNexis Risk Solutions, plus two unnamed location-data partners. Excludes insurers that pulled reports (count unknown).

Third parties: Named: Verisk, LexisNexis Risk Solutions, plus two unnamed location-data recipients (one linked by Sky News to Wejo). GM told Wyden staff it would not name the location-data partners.

Data brokers linked to General Motors (OnStar Smart Driver)

• Sold or shared data with LexisNexis Risk Solutions (RELX), confirmed. "GM publicly confirmed sharing Smart Driver data with Verisk from 2015 to 2024 and with LexisNexis Risk Solutions from 2018 to 2024; GM declined to tell Senator Wyden how many cars or what it was paid. The NYT reported 8 million vehicles." GM confirmed the sharing. The California AG separately says GM sold the data to LexisNexis from 2020 to 2024.
• Sold or shared data with Verisk Analytics, confirmed. "GM publicly confirmed sharing Smart Driver data with Verisk from 2015 to 2024 and with LexisNexis Risk Solutions from 2018 to 2024; GM declined to tell Senator Wyden how many cars or what it was paid. The NYT reported 8 million vehicles." GM confirmed the sharing, 2015 to 2024.

Confidence: confirmed means the company confirmed it or reported it in a filing. Alleged means a complaint or petition says so, with no ruling found. Reported means journalism or a Senate letter. How brokers are included

Data practices score

12 of 15. Five components, each 0 to 3. How the score works

Sells or shares

3

Enforcement

3

Retail media scale

0

Sensitive data

3

Opt-out friction

3

Estimated emissions for one person

Research gaps

• Number of vehicles whose data was sold (GM declined; only the NYT 8 million figure exists).
• Identity of GM's current unnamed location-data partner.
• Status of Texas and Nebraska suits.
• Number of insurers that bought GM-derived driving reports.