GM should have asked drivers before selling OnStar data for insurance use

If I press the OnStar button after a crash, I expect my car to share enough about me to bring help. I understand why the car needs my location because an ambulance, directions or roadside assistance cannot reach me without it. I did not understand that bargain to include a second product built from where I drove, how fast I went and when I hit the brakes. GM should have asked drivers that second question plainly.

I came to this case through Kenn Dahl. The cost of insuring his Chevrolet Bolt rose 21 percent, and his insurance agent pointed him toward LexisNexis. The consumer disclosure he requested was 258 pages long. It included details from months of driving that GM had supplied. The New York Times reported Dahl's experience in March 2024.¹

California announced a $12.75 million agreement with GM in May. The state says GM sold names, contact information, location data and driving behavior from hundreds of thousands of Californians to LexisNexis and Verisk. Its complaint puts GM's nationwide revenue from those sales at about $20 million between 2020 and 2024.²

The part I had to read twice was California's explanation of the insurance harm. State law kept insurers from using the affected Californians' driving data to raise their premiums. A driver in another state could have the same information collected and sold without that protection. California's case is still about notice and consent for its own residents, but the limit in its insurance law helps explain why Kenn Dahl's story came from Washington rather than California.

What OnStar customers thought they were getting

OnStar makes sense because it does useful things with a car's location. It can send emergency help after a crash, help recover a stolen vehicle and provide directions. GM presented Smart Driver as another useful feature: customers could review their driving and improve it. When GM ended the program, the company said it had been designed to promote safer driving.³

The FTC says GM's enrollment process left out what could happen next. Smart Driver information was sold to companies that built consumer reports for insurers. Those reports could include precise location, speed, hard braking, rapid acceleration, seatbelt use, trip timing and late-night driving. In some cases, the FTC says GM collected a vehicle's location every three seconds.⁴

I am comfortable with a connected feature using the information it needs to perform the feature. I want another decision when GM changes the purpose. If crash response or driving coaching becomes an insurance report, ask me where I can see what will be shared and what it may cost me. The purchase screen, the dealership and the driver's account all give GM places to ask that question in language a person can understand.

California's complaint says GM already had an internal privacy program that required the company to explain its uses and the outside parties that might receive customer information. I keep coming back to that point because the rule was already inside GM. I want to know why it did not stop this enrollment and sales process before a driver had to discover it through an insurance increase.

California says GM received about $20 million nationwide for the data and agreed to a $12.75 million state penalty. The five-year restriction stops GM from repeating the same sale to consumer reporting agencies. The deletion work is supposed to reach information already held by GM and the brokers. Twenty years of federal oversight gives regulators time to see whether the changes last.

Drivers will share data when they understand the exchange

LendingTree asked 2,000 U.S. adults about insurance telematics in April. Two-thirds said they would be comfortable sharing driving data if it lowered their premium. Twenty-eight percent said they would share precise location. One in five named the sharing or sale of their information as the biggest concern about these programs.⁵

My read is that people are willing to make this trade when they can see the offer. A driver may decide that mileage, braking or speed is worth sharing for a meaningful discount. Before saying yes, I would want to know who receives the information, whether a poor score can increase the rate, how long the record stays on file and how an error gets corrected. Smart Driver made too much of that decision before the customer ever saw the insurance offer.

A study funded by the United States Department of Transportation asked the question more broadly. The researchers found that intended use shaped the answer more than the type of data. People were least willing to share for enforcement or fee-related uses. The people with greater privacy and security concerns also reported less trust and less willingness to adopt a connected vehicle.⁶

Deloitte's 2024 survey covered technology providers generally, so I am using it for one limited point. Twenty-six percent of respondents said their providers offered clear privacy and security policies with easy controls. People who reported high trust spent about $1,040 on connected devices in the prior year; people reporting low trust spent about $695. I do not use that gap to say clearer controls caused the additional spending. I use it to say customer confidence belongs inside the commercial plan.⁷

GM has made changes that drivers can check

GM stopped sharing Smart Driver information with LexisNexis and Verisk in March 2024. The next month it ended Smart Driver and unenrolled every customer. GM says customer feedback led to the decision, and it later combined its U.S. privacy statements and expanded connected-vehicle privacy choices nationwide.³

The federal order approved in January turns GM's privacy promises into requirements that last twenty years. GM must receive affirmative consent before collecting, using or sharing certain connected-vehicle information, apart from services such as emergency response. Drivers must be able to request their data and its deletion, turn off precise location in vehicles that support it, and opt out of location and driving-behavior collection. GM is barred from giving those data to consumer reporting agencies for five years.⁴

California's agreement adds the $12.75 million penalty, another five-year sales ban and a 180-day clock for deleting retained driving information, with limited exceptions. GM also has to ask LexisNexis and Verisk to delete what they received. California described the agreement as subject to court approval when it announced the case, so I am treating those terms as agreed relief until the court record shows they were entered.²

GM's current U.S. privacy statement was updated June 17. It defines driving-behavior information, explains several uses and retention periods, and says a disclosure to General Motors Insurance for a quote or policy requires affirmative consent. Owners of some 2019 and newer vehicles can disable location services in the infotainment system. A customer can also disconnect the vehicle from OnStar, with emergency and battery-safety exceptions still in place.⁸

I would test all of this from the driver's seat. Can I find the setting without calling anyone? Can I see what GM already has about my car? If I ask for deletion, how long does it take and do the brokers confirm that their copy is gone? If a bad event reaches an insurer, I need a person with enough authority to trace where it came from and correct it before the next premium is due. GM can publish the completion times and the number of requests that required a correction.

GM's business stayed strong after the Smart Driver case

California announced its agreement after trading ended on Friday, May 8. GM shares fell 4.45 percent in the next session while the S&P 500 rose 0.23 percent. That Monday also brought news that GM was cutting roughly 600 information-technology jobs. The coverage of the weekly decline pointed to both stories. I cannot pull a clean privacy-settlement reaction out of a day when investors were also learning about a sizable layoff.⁹

By August 5, GM had more than recovered the May decline. It closed at $89.16, about 13 percent above its May 8 price. GM also remained the largest U.S. automaker by second-quarter sales with 714,896 vehicles delivered, although that was 4.2 percent lower than a year earlier. The company recognized about $800 million in second-quarter revenue from digital services, including OnStar and Super Cruise.¹⁰

I do not think a GM buyer walks into a dealership and makes one decision about the company's character. Imagine a family replacing a truck that no longer works. The Chevrolet at the nearby dealer can tow what they need, the financing fits and the family already knows the brand. Their purchase tells GM what they chose to drive. If I want to know how they feel about the data sale, I have to ask them.

I use the stock price to understand what investors did with the whole set of news around GM. An investor can like the company's margins, buyback or prospects for connected services and still think Smart Driver was handled badly. The sales and market signals show that GM remained a strong business after the case. Driver complaints, disputes and customer research are the better places to look for what people thought about the data sale.

The $800 million digital-services figure is the reason I would put these privacy choices inside the product plan. GM wants OnStar, Super Cruise and future in-car services to become a larger part of the company. The vehicles will collect more as cameras, driver-assistance systems and in-car AI become common. While the product team decides how a feature will make money, it should also have to explain how a driver sees the collection, chooses each use, leaves the program and gets a wrong record corrected.

What I would want to see next

I use four questions when I read a case like this: who takes responsibility, what the customer can verify, where the customer gets to choose and what happens after the information causes harm. Our current AI Trust studies did not ask people about GM, OnStar or insurance reports made from connected-car data, so applying those questions here is my judgment.

GM is responsible for the sale and for the enrollment design that allowed it. The company ended Smart Driver and the broker relationships, then accepted twenty years of oversight. I now want GM to report whether every required deletion was completed and whether every promised customer control works in the vehicles and accounts where drivers are supposed to use it.

A driver should be able to verify the basic record without becoming a privacy lawyer. Show what the car collects, why GM needs it, how long it stays and every outside company allowed to receive it. Put that information in the account and on the vehicle screen. Kenn Dahl found the useful version only after his premium rose, buried inside a 258-page consumer disclosure. He should have had it in front of him before he joined Smart Driver.

GM also needs to ask again when it wants to use the information for something new. I may want my location shared with an ambulance and refuse to have the same trip scored for insurance because those uses create different consequences for me. The Smart Driver survey tells us many drivers may accept a telematics program for a lower premium, so let them see that offer and decide for themselves.

I worry most about the driver whose report has already reached an insurer. Access and deletion rights are useful, but that person also needs to know which report was used, how to dispute the recorded events and who at GM or the broker can fix the information before another premium is charged. A help page that sends the driver in a circle would fail at the moment the company most needs to show that the new controls work.

I still want OnStar to know where my car is after a crash. I would keep the service on for that reason. If GM wants to use the same information for another business, it should tell me what that business is and ask again. The orders now require much of that work. Drivers will judge the result by opening their accounts, checking the vehicle screen and, when something goes wrong, reaching a person with authority to fix the record.

Source notes

Kashmir Hill, The New York Times, Automakers Are Sharing Consumers' Driving Behavior With Insurance Companies, March 11, 2024, for Kenn Dahl's 21 percent insurance increase, the LexisNexis referral and his 258-page consumer disclosure. The direct article may require a subscription. California's later complaint cites the same investigation as the event that brought the practice to public attention.
California Department of Justice, May 8, 2026, and the linked court-stamped complaint, for the $12.75 million agreement, hundreds of thousands of California customers, approximately $20 million in alleged nationwide data-sale revenue, California insurance-law limitation, deletion requirements and five-year restrictions. The announcement describes a settlement subject to court approval; a later public court-entry record was not located during the August 6 refresh.
General Motors, April 24, 2024, for ending Smart Driver based on customer feedback and unenrolling customers. General Motors, January 16, 2025, for the company's description of ending LexisNexis and Verisk relationships, consolidating privacy statements, expanding controls nationwide and agreeing to the federal order. These are GM's accounts of its intent and response.
Federal Trade Commission, January 14, 2026, for final approval of the twenty-year order, the five-year consumer-reporting-agency ban and nationwide consent, access, deletion and opt-out requirements. The linked administrative complaint supplies the enrollment, collection-frequency and data-category allegations. The order resolves allegations and does not state that GM admitted them.
LendingTree, 66% of Drivers Would Share Driving Data to Lower Insurance Rates, May 18, 2026, for the 66 percent willingness figure, 28 percent precise-location figure and concerns about data sharing or sale. QuestionPro fielded the online survey of 2,000 U.S. adults April 13–17 using a nonprobability sample and population quotas. The figures describe these respondents and should not be read as precise national estimates.
Sailesh Acharya and Michelle Mekker, Public Perception of the Collection and Use of Connected Vehicle Data, 2021, a U.S. Department of Transportation University Transportation Centers-funded report, for the associations among intended use, data-sharing willingness, privacy and security concerns, trust and connected-vehicle acceptance. The study predates the public OnStar reporting and does not measure reaction to GM.
Deloitte, 2024 Connected Consumer Survey, for the clarity-and-control trust groups and connected-device spending figures. The spending result is an observed correlation. It does not establish that trust or clearer controls caused the difference, and the survey covers technology providers broadly rather than connected vehicles alone.
General Motors U.S. Consumer Privacy Statement, last updated June 17, 2026, for current definitions, use and disclosure terms, retention periods, location controls, OnStar disconnection and affirmative consent for disclosures to General Motors Insurance. A published policy is evidence of the stated system. This article does not independently verify every customer flow or deletion outcome.
StockAnalysis GM historical prices and SPY historical prices, checked August 6, 2026, for the May 8 and May 11 unadjusted closes. GM moved from $78.80 to $75.29, or -4.45 percent; SPY moved from $737.62 to $739.30, or +0.23 percent. The site identifies S&P Global Market Intelligence as its historical-data source. TechCrunch, May 11, 2026, documents GM's same-day IT layoffs. GM Authority's weekly market review cited both the layoffs and privacy settlement. Event attribution is therefore not supportable from price timing alone.
StockAnalysis GM historical prices, checked August 6, 2026, for the May 8 close of $78.80 and August 5 close of $89.16, a 13.15 percent increase calculated from unadjusted closes. General Motors, July 1, 2026, for 714,896 second-quarter U.S. deliveries, sales leadership and the 4.2 percent year-over-year decline. GM's Q2 2026 earnings deck and results report approximately $800 million in recognized digital-services revenue, including OnStar and Super Cruise, up more than 20 percent year over year. These business signals have many causes and do not measure customer approval of the discontinued Smart Driver practice.

McQueen Analytics research note

McQueen Analytics' 2026 AI Trust work draws on four U.S. adult online-panel surveys fielded from late May through June 12. Claim review remains underway and final population weighting is incomplete. The surveys covered other subjects. Responsibility, verification, choice and recourse are applied here as Carl McQueen's evidence-informed interpretation, with no OnStar conclusion attributed to survey respondents.