Your GM Car Was Spying on You for Insurance Companies

What GM Did

GM marketed OnStar Smart Driver as a way to "improve your driving habits." What they didn't tell you: the feature tracked every trip you made and sent detailed behavior profiles to data brokers.^[1]

The data included:

• Precise geolocation: where you went and when
• Speeding frequency: how often you exceeded limits
• Hard braking events: sudden stops flagged as risky
• Rapid acceleration: marked as aggressive driving

GM sold this data to LexisNexis Risk Solutions and Verisk. Both are consumer reporting agencies, the same type of companies that generate your credit reports. The same data-broker pipeline that resells your location also lets government agencies buy it without a warrant.

How It Raised Your Insurance Rates

LexisNexis and Verisk didn't just collect your driving data. They packaged it into "risk scores" and sold those to insurance companies.^[2]

The FTC called this an "egregious betrayal of consumers' trust."

Here's the pipeline:

1. You enroll in OnStar Smart Driver, thinking it'll help you drive safer
2. GM collects every trip, every hard brake, every time you go 5 over
3. GM sells that data to LexisNexis and Verisk
4. Those brokers sell it to State Farm, Allstate, Progressive, and others
5. Your insurance premium goes up because an algorithm flagged you as "risky"

You never consented to any of this. The enrollment process buried disclosure in fine print. Most customers had no idea their car was generating data that would cost them money.

The "Consent" Fiction

GM claims customers agreed to data collection. The FTC disagreed.^[3]

According to the FTC complaint, GM used a "misleading enrollment process" for OnStar connected services and Smart Driver. The company failed to clearly disclose that:

• It collected precise geolocation from vehicles
• It collected detailed driving behavior data
• It sold this data to third parties
• Those third parties were consumer reporting agencies
• The data would be used to set insurance rates

GM's response has been predictable. The company says its "own systems were never breached" and that data brokers were "contractually obligated" to maintain security. That's not the point. You didn't know your car was spying on you.

What the Settlement Requires

The FTC finalized the order on January 14, 2026, voting 2-0 to approve. Here's what GM must do:^[4]

• Five-year data selling ban: GM cannot share geolocation or driving behavior data with consumer reporting agencies
• 20-year consent requirement: GM must obtain "affirmative express consent" before collecting, using, or sharing connected vehicle data
• Data deletion: GM must delete or destroy all previously collected driver data, except where legally required for law enforcement
• Consumer rights: Customers get access to their data, deletion rights, and meaningful opt-out options

There's no financial penalty. GM paid nothing in fines. The company says it has "already begun complying" with the new requirements. Customers picking up new GM vehicles are now asked at the dealership whether they want to allow data collection.

Timeline

• March 2024: The New York Times reports GM is selling driver data to LexisNexis and Verisk
• April 2024: GM discontinues OnStar Smart Driver program
• January 2025: FTC announces proposed settlement
• January 14, 2026: FTC finalizes the order with 2-0 vote

GM killed Smart Driver less than two months after the Times investigation. They knew exactly what they were doing.

The Bigger Picture

GM isn't alone. Every major automaker collects vehicle data. Most privacy policies are written to maximize what they can collect and share.

The FTC called this case the first to target connected vehicle data practices. But enforcement against one company doesn't fix the industry.

Michigan's insurance regulator admitted that state law doesn't prohibit insurers from using third-party data in ratemaking. Your state probably doesn't either.

If you drive a connected car made after 2015, assume it's collecting data. The question is whether it's selling that data to companies that will use it against you.

What You Can Do

• Opt out everywhere: Check your car's infotainment settings, manufacturer app, and any connected services
• Request your LexisNexis report: Get your Consumer Disclosure report at consumer.risk.lexisnexis.com/request
• Request your Verisk report: Check for driving data at Verisk consumer FAQ
• Disable telematics if possible: Some vehicles allow disabling data transmission entirely
• Ask your insurer: Request confirmation of what third-party data sources they use for rating

Related Coverage

• Federal Car Surveillance Mandatory by 2027: New law requires eye-tracking cameras in all new cars
• Connected Car Data: Your Vehicle Is Reporting You: What your car collects and who gets it
• Your Car Sold You Out to Your Insurance Company: How automakers turned vehicles into data harvesting machines
• Your Weather App Is a Government Spy: How Ad Data Tracks 500 Million People: The same location-data market that priced your insurance also feeds surveillance