The car reported back. What drivers can check, and what they can stop.
By Callahan Blackwood | November 7, 2026
Regulators allege General Motors collected precise driving data from millions of vehicles through its OnStar Smart Driver program, sold it to LexisNexis and Verisk without drivers' knowledge, and exposed some drivers to insurance rate changes they never agreed to. Three separate enforcement actions produced more than $233 million in settlements. Drivers received no direct compensation in any of them.
The dealership employee who signed you up for OnStar may not have asked whether you also wanted to enroll in Smart Driver. According to a coalition of 36 state attorneys general, that was often by design.
From 2016 to 2024, General Motors enrolled millions of drivers in Smart Driver, a feature billed as a personal safety tool that scored individual trips and tracked driving habits. Regulators allege GM did not prominently disclose that it sold data from that program to two firms central to the insurance information industry: LexisNexis Risk Solutions and Verisk Analytics. Those companies built driver profiles that auto insurers could purchase when setting rates. The New York Times reported in 2024 that some drivers saw their premiums increase after this data reached their insurers, though the precise rate impact on individual consumers was not established across all states.
That pipeline ran for the better part of a decade before unraveling under three overlapping enforcement actions: a Federal Trade Commission consent order, a $12.75 million California civil penalty, and a $220 million multistate settlement announced in October 2026. Together they close one documented case. They do not establish a federal standard governing connected vehicle data.
The Enrollment Machine
Understanding the pipeline requires starting at the dealership.
GM's OnStar service offers emergency response, navigation, and remote diagnostics. Smart Driver was a newer layer within OnStar, designed to score trips and generate individual driving reports. The two programs shared a single enrollment process, and that bundling mattered.
The multistate attorneys general found that in many cases, dealership employees accepted Smart Driver's terms and conditions on behalf of customers without obtaining their actual agreement. GM ran an aggressive enrollment incentive structure at the time: employees received bonuses tied to OnStar sign-ups, and dealerships were ranked by their enrollment numbers. Sign-up rates climbed. The precision of consent declined.
GM told drivers that Smart Driver data would not be shared with insurers without express consent. That representation appears repeatedly in regulators' findings, and the gap between that statement and actual practice is what converted a privacy complaint into a fraud allegation.
What Smart Driver Collected
Smart Driver captured granular, identifiable data about how individual people drove individual vehicles. The multistate settlement documents describe the collected information as including trip frequency, trip start and end times, hard-braking events, rapid acceleration counts, and whether a driver exceeded posted speed limits. The California complaint adds precise geolocation to the list, tracking movements with specificity that can reveal where a person lives, works, or sends their children to school.
The data attached to named individuals and specific vehicles. That identification was the product's commercial value: LexisNexis and Verisk needed driver-level profiles, not aggregate statistics. According to the California Attorney General's complaint, GM reportedly made approximately $20 million nationwide from these data sales.
The Data Brokers and the Insurance Market
LexisNexis and Verisk both operate consumer reporting functions, assembling driver histories and risk profiles that insurers purchase to underwrite auto policies. When GM sold Smart Driver data to them, regulators allege it did so under contracts specifying the data was intended for insurance products.
Both companies purchased the data intending to develop driver-rating products for auto insurers. The Maine attorney general's office found that for many consumers, this data was used by insurance companies in part to set insurance rates. The New York Times documented downstream effects in 2024, reporting that some drivers had seen premiums increase after their data reached insurers. That reporting named GM explicitly. Within weeks of publication, GM discontinued Smart Driver.
The California investigation found that state drivers were not directly impacted by rate increases, likely because California law prohibits insurers from using telematics data to set rates. That carve-out did not change the underlying data transfer or the deceptive disclosure regulators alleged in the other states.
The 380,000-Driver Error
One detail in the multistate settlement filing stands on its own.
According to the attorneys general, GM's OnStar app told 380,000 drivers they were not enrolled in Smart Driver. They were enrolled. GM was collecting and selling their data throughout the period when the app reported otherwise. When the error came to light, GM unenrolled those 380,000 drivers without notifying them of the mistake or the data that had already left the company. That data remained with LexisNexis and Verisk.
A system failure followed by a silent correction that left the data problem intact. That sequence reflects the information asymmetry at the core of the case. Drivers had no reliable way to verify what their vehicles were transmitting or where it was going.
Three Enforcement Actions, Three Different Results
The regulatory response has been real but uncoordinated. The gap between the three actions matters as much as the actions themselves.
The FTC consent order, finalized January 14, 2026, prohibits GM from sharing consumers' geolocation and driver behavior data with consumer reporting agencies for five years. For the full 20-year life of the order, GM must obtain affirmative express consent before collecting, using, or sharing connected vehicle data; provide consumers a mechanism to request and delete their data; allow consumers to disable precise geolocation collection where vehicle technology permits; and maintain opt-out mechanisms for geolocation and driver behavior data. The Commission voted 2-0 to approve. It described the five-year ban as appropriate given what it called GM's "egregious betrayal of consumers' trust."
The FTC order carries no financial penalty and directs no compensation to affected drivers. It is a conduct order: it creates obligations GM must meet under federal oversight for two decades.
The California settlement, announced May 8, 2026, produced $12.75 million in civil penalties, the largest CCPA penalty in California history at the time and the state's first action enforcing the CCPA's data minimization principle. Attorney General Rob Bonta's office, joined by the California Privacy Protection Agency and four county district attorneys, found that GM retained location and driving data beyond the period needed to operate OnStar and then sold that retained data to LexisNexis and Verisk for insurance purposes. The civil penalties flow to California, not to affected drivers.
The multistate settlement, announced October 29-30, 2026, involves 36 attorneys general and a $220 million payment from GM. Washington and Oregon led the coalition; Maine, one of the joining states, will receive $2,840,788 of the total. Oregon Attorney General Dan Rayfield put it plainly: "People bought a car, not a tracking device."
The multistate terms require GM to obtain affirmative express consent before collecting or disclosing driving and location data, to limit data collection going forward, to delete consumer driving data on request, and to submit to dealership oversight and training requirements. The coalition described its resolution as significantly stronger than any other reached over this conduct, citing a requirement for both internal and external data protection and privacy program assessments as the key distinction.
The $220 million goes to the states. The settlement does not create a claims process for individual drivers.
What GM Says
GM's public position has been consistent since the initial FTC settlement announcement in January 2025. The company describes Smart Driver as a program designed to promote safer driving that was discontinued in April 2024 in response to customer feedback. It ended data-sharing relationships with LexisNexis and Verisk at that time and consolidated its U.S. privacy disclosures in September 2024. A spokesperson responding to the multistate settlement said the resolution reinforces steps GM has already taken, expressing a commitment to being "clear about what information is used, how it's protected, and the choices customers have about what they share."
GM did not admit wrongdoing in any of the three settlements. Smart Driver no longer exists as a GM product.
Voluntary UBI Is Not the Same Practice
The GM enforcement actions apply to a specific set of facts. They should not be read as a blanket indictment of all connected vehicle programs.
Voluntary usage-based insurance, commonly called UBI or telematics insurance, operates on a different basis. Programs associated with insurers such as Progressive, Allstate, and Geico ask drivers to opt in explicitly, disclose at enrollment that driving data will inform rate calculations, and offer potential premium discounts in exchange for participation. The consumer knows the purpose. The insurer is named upfront.
The conduct regulators targeted in the GM case was structurally different. Smart Driver was sold as a personal safety and self-improvement tool. GM made representations that data would not reach insurers without express consent. Regulators allege it was then sold to two firms whose stated purpose was to supply insurance markets. The violation, as alleged, was not that driving data affected rates. It was that the transfer happened without the disclosure GM had promised.
Whether other automakers have operated comparable programs is an open regulatory question. California's privacy agency announced connected vehicle investigations beyond GM in 2023. Those proceedings have not produced public resolutions comparable to the GM enforcement actions.
What the Orders Leave Open
Three enforcement actions do not add up to a comprehensive framework.
The FTC order governs GM's future conduct under a consent decree. The California settlement applies state privacy law to one company's past practices. The multistate settlement provides $220 million to state governments and imposes behavioral requirements, but its enforcement depends on the ongoing capacity of 36 separate attorneys general offices.
No federal statute specifically governs how automakers collect, retain, and sell connected vehicle data. Proposals for comprehensive federal privacy legislation have not advanced to enactment. State laws vary substantially: California's data minimization requirements do not apply uniformly elsewhere.
The data that left GM's systems over eight years is held by LexisNexis and Verisk. The settlement requires GM to request deletion from those companies. Whether and how completely that deletion occurs is not publicly verified in the terms as released.
A Driver Audit: Questions Grounded in the Orders
The FTC final order and the multistate settlement created specific rights and obligations that current and former GM vehicle owners can act on now.
Did you own or drive a GM vehicle between 2016 and 2024? The multistate settlement covers Smart Driver enrollment during that period. Chevrolet, GMC, Buick, and Cadillac vehicles connected to OnStar were the relevant platforms.
Were you enrolled in Smart Driver? The enrollment-status error means 380,000 drivers received inaccurate information from the OnStar app. If you owned a GM vehicle during this period, your enrollment status as displayed may not have matched what GM's systems recorded.
Can you request your data? Under both the FTC order and the multistate settlement, GM must provide all U.S. consumers access to their personal data and the ability to request deletion. The company's US Consumer Privacy Request Form is at gm.com/consumer-privacy. GM also operates a privacy line at 1-866-MYPRIVACY (1-866-697-7482).
Did your insurance rate change unexpectedly between 2016 and 2024? The settlements do not establish a claims process for affected drivers. If you believe a rate change reflected telematics data, options include requesting information from your insurer about data sources used in your underwriting, reviewing your LexisNexis consumer disclosure through its consumer center, and filing a complaint with your state attorney general's consumer protection division.
What about your current vehicle? The FTC order requires affirmative express consent before GM collects, uses, or shares connected vehicle data going forward. Review GM's current privacy statement before enabling connected services. Toggle location-sharing and behavioral monitoring in your vehicle settings or the MyChevrolet or MyGMC app.
Sources
FTC final order press release (January 14, 2026): https://www.ftc.gov/news-events/news/press-releases/2026/01/ftc-finalizes-order-settling-allegations-gm-onstar-collected-sold-geolocation-data-without-consumers
FTC case file, General Motors LLC et al.: https://www.ftc.gov/legal-library/browse/cases-proceedings/2423052-general-motors-llc-et-al-matter
FTC final complaint (PDF): https://www.ftc.gov/system/files/ftc_gov/pdf/2423052c4828gmlexisfinalcomplaint.pdf
FTC commenter letters (PDF): https://www.ftc.gov/system/files/ftc_gov/pdf/2423052c4828gmlexiscommenterletters.pdf
Maine AG multistate release (October 29, 2026): https://www1.maine.gov/ag/news-and-library/press-releases/gm-pay-220m-sharing-drivers-private-data-case-joined-attorney
New York AG press release index: https://ag.ny.gov/press-releases/9/all
California AG settlement (May 8, 2026): https://oag.ca.gov/node/622991
GM response statement (January 17, 2025): https://news.gm.com/home.detail.html/Pages/news/us/en/2025/jan/0117-gm.html
Insurance Journal, "GM to Pay $220M to Settle Privacy Claims Over Sale of Driver Data to Insurers" (October 30, 2026): https://www.insurancejournal.com/news/national/2026/10/30/890832.htm
AP background: https://apnews.com/article/a555abb56a0d5f31afa9b73c3eb48287
