What actually happened with GM and OnStar?

GM's OnStar Smart Driver program collected driving behavior — hard braking, hard acceleration, speeding over 80 mph, and late-night drive time — from enrolled vehicles and sold it to the data brokers LexisNexis and Verisk. Those brokers packaged it into consumer reports that some insurers used to set rates, and some drivers saw their premiums rise with no clear explanation. A 2024 New York Times investigation surfaced it; GM discontinued Smart Driver and ended both broker relationships that April.

Does this apply to cars other than GM's?

GM is the automaker with a finalized federal enforcement action naming this exact practice, which is why it's the sourced case study here. Connected-vehicle data collection generally — location, speed, braking — is a standard feature across most modern cars' built-in telematics and companion apps; whether any other specific manufacturer shared it with a consumer reporting agency the way GM did isn't something this page asserts, because it isn't documented the same way. Check your own car's privacy settings rather than assume either way.

How is this different from the rental-car tracker page?

That page is about a tracking device a person added to a rental, or data you leave behind by pairing your phone to a car you don't own. This page is about a car you own, and a manufacturer's own built-in connected-services program reporting your driving behavior to a company you never dealt with directly. Different device, different actor, same underlying question: who sees data your car generates.

Your own car, not a hidden tracker

Does your car report your driving to your insurer?

Q: Is this resolved now?

The FTC's complaint, first announced in January 2025, alleged GM used a misleading enrollment process and never clearly disclosed it would collect and sell location and driving data. The Commission finalized its order on January 14, 2026 (a 2-0 vote): GM is barred from sharing geolocation or driver-behavior data with consumer reporting agencies for five years, and for 20 years must get affirmative express consent before collecting, using, or sharing connected-vehicle data, plus offer access, deletion, and opt-out. There was no financial penalty — the order is about changing the practice, not punishing it after the fact.

Everything else on this site about vehicles is about a device someone else added. This one is about a feature your own car already has: built-in connected services that can report how you actually drive to companies you've never heard of.

What actually happened

From at least 2022 until April 2024, GM's OnStar "Smart Driver" program collected driving behavior — hard braking, hard acceleration, speeding over 80 mph, and late-night drive time — from enrolled vehicles and sold "select insights" from it to two data brokers, LexisNexis and Verisk. Those brokers compiled it into consumer reports; some insurance companies used those reports to help set rates, and some drivers reported premium increases with no clear explanation until they requested their own file. A March 2024 New York Times investigation brought the practice to light. GM discontinued Smart Driver and ended both broker relationships that same month.

The FTC's finalized order

The FTC's complaint, announced in January 2025, alleged GM ran a misleading enrollment process for Smart Driver and never clearly disclosed that it would collect and sell consumers' precise location and driving data. The Commission finalized its order on January 14, 2026, by a 2-0 vote: GM may not share geolocation or driver-behavior data with consumer reporting agencies for five years, and for 20 years must obtain affirmative express consent before collecting, using, or sharing connected-vehicle data, with access, deletion, and opt-out systems required. There was no financial penalty attached — the order changes the practice going forward rather than fining GM for what already happened.

Same pattern as the rest of this site: this isn't a stalker story. It's a company's enrollment flow and a data-broker pipeline most owners never saw, not a criminal plot aimed at any one driver.

What you can actually check

Open your car's companion app. Look for a "driving score," "Smart Driver," or similarly named feature, and check whether you're enrolled — some programs opt you in by default during initial setup.
Request your own file. LexisNexis and Verisk are both required to provide consumers a free copy of their own consumer disclosure report on request — the same right you have with a credit bureau. If driving data about you was ever sold, this is how you'd see it.
Check your manufacturer's connected-services privacy settings directly rather than assume GM's practice was unique to GM — the underlying telematics hardware that makes this possible is standard across most late-model cars, even where no enforcement action exists yet.
If you're buying or leasing, ask the dealer directly whether the connected-services enrollment shares driving data with third parties, and decline the enrollment if you'd rather not find out later.

Cover: The Traveler's Counter-Surveillance Field Manual

The Field Manual — PDF edition

Covers the device someone else might add to a car you're driving — a different question from what your own car's manufacturer collects. The complete system — every check on this site plus the ten-minute walkthrough, audio devices, your legal rights, and what to do if you find something. 47 printable pages, instant download, keep it on any device.

Skip and go straight to checkout

Also worth reading

Checking a car you don't own — a rental, a loaner — for a tracker someone added, or cleaning up the contact and navigation data you leave behind when you pair your phone? The GPS tracker page covers that side of vehicles; this one is about your own car's manufacturer-installed telematics instead.

Keep going

The 90-second room sweepFour steps, no gear — the check to run when you arrive. Find hidden cameras in an AirbnbWhere devices actually hide, and the rules hosts must follow. Airbnb vs. Vrbo vs. Booking.comThree platforms, three different lines on indoor cameras — which one applies to your booking. The flashlight trickThe one free method that catches a camera even when it is off. The two-way mirror testWhy the fingernail trick doesn't work — and what does. Do detector apps work?What a controlled lab study found when 11 apps met real hidden cameras. Find a GPS tracker on a carThe 60-second check, plus the data your rental car keeps. Unknown AirTag alert?What the tracker warnings can and cannot do, and the manual check. Found something? Do thisThe order matters: don't touch it, cover your sightlines, document. Check a hotel room for hidden camerasDifferent risk than a rental, same 90 seconds — plus the housekeeping tell. Bugged? Here’s the honest answerAudio is a different problem than cameras — what actually finds a bug, and what can’t be found. Is a hidden camera illegal?The federal law, the state law, wiretap rules, and platform policy — in plain English. The Workplace Privacy ChecklistWhat your employer can actually see, and the 10-minute check that tells you where you stand. The Renter's Smart-Home Privacy ChecklistWhat landlord-installed smart locks and sensors can log, and the move-in check that tells you where you stand. Remove yourself from 30 people-search sitesDirect opt-out links, honestly rated — no paid removal service required. Is your smart TV spying on you?What ACR tracking actually does, and the one setting that turns it off. Is your own camera exposed online?The two-minute check for a baby monitor or home camera you own — not one someone hid. Neighbor's camera pointed at your house?What you can ask for, what the law actually protects, and when it crosses a line. Is an AI notetaker recording your meetings?Zoom AI Companion, Otter, Fireflies, Granola — the signs it’s on, and the lawsuits now testing whether that’s legal. Who else can see your doorbell camera?Police requests, employee access, and what actually changed in 2024 — your own camera, not a hidden one. Does your neighborhood have a license-plate camera?What Flock-style cameras at a gate or entrance actually keep, the August 2026 retention change, and how to ask your HOA or building. Does Alexa, Siri, or Google Assistant record you?The 2019 human-review stories for all three, what changed since, and the setting that actually limits it. Does your robot vacuum photograph your home?Where the images go, two documented cases, and the settings that actually limit it. Do smart toys record your child’s voice?Two documented breaches, and the four questions to ask before a connected toy goes in the toy box. Does your fitness tracker’s data belong to you?The insurance discount that wants it, and three real cases where it ended up in a courtroom instead.