// analysis
GM and OnStar: the trade in driving data
GM, OnStar, Verisk and LexisNexis: vehicle data, the $220 million settlement and drivers’ rights in the insurance-data market.
Sources and reading context
Topics
Contents8 sections
Imagine an ordinary commute. A driver leaves a car park in the morning, accelerates onto a main road, brakes hard at a junction and arrives at work. The car can generate very different kinds of information along the way: speed, acceleration, diagnostic codes and location. Telematics covers the remote exchange of such information. S05 Some information may stay on board. Some may travel to remote services, depending on the vehicle and the settings. Once it leaves the car, it may also cross from one business relationship into another.
In the United States, that commercial journey has led to a series of proceedings involving General Motors and OnStar, its connected-vehicle service. On October 29, 2026, 36 attorneys general announced a settlement providing for $220 million in payments to participating states. Their investigation concerned driving data sold to brokers serving the insurance market. The announced settlement amount is separate from the revenue generated by those sales. S11S12
The case involves Smart Driver, a feature that offered driving feedback. Authorities challenged how drivers were enrolled and informed about data sharing. The Federal Trade Commission (FTC), the federal consumer-protection agency, and California had already reached separate settlements. The documents examined here set out settlement terms and allegations attributed to the authorities. S01S02S03S11
Method and scope
Qualitative diagram of historical commercial relationships; arrow widths represent neither volumes nor money. Verisk and LexisNexis contracts cover different fields. The use and consequences at a particular insurer require separate evidence; this diagram does not establish equivalent French flows.
From a braking event to a commercial product
Inside the car, sudden braking is an observation. In a data supplier’s system, repeated observations can become inputs to a driving score. An insurer may regard the score as potentially useful when estimating risk, subject to applicable law and the quality of the model. These are different transformations, performed by different actors for different purposes.
In the GM case, the FTC challenged the sign-up process for OnStar and Smart Driver and the sale of driving behavior and precise location information. The final order was issued on January 13, 2026 and announced the following day. It prohibits disclosure of covered driving and location data to consumer reporting agencies for five years. Other provisions address consent, access, deletion and the ability to disable collection within the order’s overall twenty-year term. Exceptions for certain processing requested by a driver apply to those other provisions; the five-year disclosure ban remains in force. S01S02
According to the California authorities, GM supplied Verisk and LexisNexis Risk Solutions with data that the firms intended to use in products for automobile insurers. The California DOJ said GM reportedly made about $20 million nationwide from these sales. The figure describes the cumulative proceeds attributed to the sales at issue nationwide. S03S04
Method and scope
California complaint of May 8, 2026, §§14–15, pages 6–7. Both flows contain identifiers and driving observations. The diagram follows contractual terms and alleged deliveries rather than a technical audit of files. Removing precise GPS does not de-identify records containing names and addresses.
The two deliveries were materially different. The California complaint, re-examined for this article, describes the difference: the Verisk contract called for identity-linked driving information while excluding precise GPS coordinates. The same complaint says LexisNexis also received precise GPS information, which it did not use to calculate driving scores. The fields a broker acquires, the fields it actually models, and the output an insurer buys must be kept separate. S04
Connecting a data transfer to an insurance decision
A commercial transfer and an insurance decision are separate steps. The public record documents sales to two suppliers, their intended market and alleged consequences for some US consumers. Attributing an individual premium increase requires the report supplied, the insurer’s actual use of it and other rating factors. A complete customer list and the insurers’ pricing models remain outside the documents examined here. S01S02
California offers an especially important qualification. The state’s investigation said insurers had not requested reports concerning California drivers and did not find premium increases there attributable to GM’s data sales. The state has restrictions on using driving data for rate-setting. That finding does not erase the privacy issue: a contested disclosure can matter even without a demonstrated price increase. S03 S04
There are two questions here. Did personal information travel beyond the service consumers thought they were using? And did the information subsequently affect an insurer’s decision? The first can be investigated through transfer records, contracts and notices. Answering the second requires evidence of the downstream report, the insurer’s actual decision process and other relevant rating factors.
The dates tell a more precise story
Method and scope
Ordinal timeline: spacing aids reading and does not encode elapsed time. Sharing ended March 20, 2024 according to GM’s April 24 release; FTC announcement January 16, 2025; order issued January 13, 2026, announced January 14; California announcement May 8; multistate announcement October 29; scheduled November 30 effective date remains future at the October 31 cutoff. Announced payments are not represented as completed.
In a statement published on April 24, GM said it had stopped sharing with LexisNexis and Verisk on March 20, 2024. The FTC announced its case on January 16, 2025, then announced the final order on January 14, 2026; the order itself had been issued the previous day. California announced a settlement on May 8, 2026, including $12.75 million in civil penalties and obligations concerning data governance and deletion. The proposed civil penalty is separate from the roughly $20 million in reported sales proceeds. S01S02S03S04S13
The October 29, 2026 announcement adds a $220 million settlement with the attorneys-general coalition. The agreement copy examined here specifies an effective date of November 30, 2026, followed by payment to the states within thirty days. That schedule lies ahead of this article’s October 31 cutoff. The agreement also establishes data-protection requirements and oversight of dealership enrolment; GM settles the allegations without admitting liability. The three amounts describe separate transactions and proceedings. S11S12
The dates matter because the transfers at issue are historical. Their contemporary significance is the model they reveal: a consumer-facing feature can generate inputs for a much less visible commercial market.
Europe has a different legal structure
In France, the analysis starts with EU rules. The General Data Protection Regulation (GDPR) governs personal-data processing, while ePrivacy rules can also apply to accessing information stored in connected equipment, including vehicles. The European Data Protection Board’s connected-vehicle guidance favors local processing where feasible and data minimization. The applicable legal basis and safeguards depend on the purpose and the specific processing activity. S07
In June 2026, France’s data-protection authority, the CNIL, issued recommendations on connected-vehicle location data. Travel histories can reveal highly personal routines and frequented places. Its document covers private owners and lessees and distinguishes legal obligations, recommendations and good practices. It addresses minimisation, retention, security and changes of user. Employee vehicles require a separate analysis. S05S06
The European Data Act has applied since September 12, 2025. It introduces rules governing access to data generated by connected products, including vehicles, and can help independent providers offer repair or maintenance services. Personal-data protection continues to apply. Vehicle-specific guidance issued by the Commission on the same day explains that access covers readily available raw or preprocessed data. The guidance lists driving scores among examples of inferred or derived data, produced by analysis that creates new insights and excluded from that chapter of the Data Act. The original observations and the commercial assessment therefore retain different legal treatment. S08S09
A separate date matters for newer vehicles: the requirement to design connected products and related services for data access applies to those placed on the market after September 12, 2026. That timetable is distinct from the regulation’s general application since September 2025. S14
Match data collection to the service
Roadside assistance may need location when help is requested. A repair service may need a fault code. Mileage-based insurance may need distance traveled rather than a full map of every journey. These examples illustrate why the amount and detail of data collected should reflect a defined purpose.
Practical control goes beyond a checkbox. Drivers need intelligible information on recipients, purposes, retention and the consequences of their choices. They can explore applicable access and deletion rights and the vehicle’s settings, while recognising that some safety functions have distinct requirements. CNIL also highlights the importance of clearing or disconnecting user data when a vehicle changes hands. S05S06
Contracts and decisions to examine in France
An investigation into the French market would need contracts and evidence: the actual data categories shared by manufacturers and telematics companies, named recipients, insurer statements about variables they use, and where appropriate technical examinations of data flows. Any claim that a particular driver’s premium was influenced would then require a documented decision path. That final step would connect the technical data flows to their consequences for drivers.
The GM case shows what happens when the economics of connected services become detached from a driver’s understanding of the product. The durable question is who controls the journey of the data once it leaves the vehicle.
Method. Documentary investigation as of October 31, 2026, Paris time. Complaints, orders, published settlements and institutional recommendations retain their distinct status. Contested conduct is attributed to the authorities; GM’s statements are identified as its account. The opening commute is illustrative. Diagrams explain relationships and dates without fabricated quantitative observations. The opening image is a conceptual illustration generated for this article. The French section addresses rights and the evidence a local investigation would require.
Further reading
Our analysis of personal-data buyers and their contracts separates delivered information from the product sold downstream. This new article adds the October 29 settlement announcement and the rights specific to connected vehicles. S10
Sources and references
Documents accessed October 31, 2026. Each notice distinguishes the document’s status, the scope used and the limits of interpretation.
- FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers’ Informed Consent
Announcement of the final order and its restrictions on GM and OnStar.
Passages and scope
Introduction and list of requirements; published January 14, 2026.
The enforcement authority’s account of a settlement. S02 supplies the operative terms.
- General Motors LLC., et al., In the Matter of : dossier 2423052, C-4828
FTC case C-4828: complaint and final order issued January 13, 2026.
Passages and scope
Order §§I–II, pages 5–6; §§VII–X, pages 8–10; §XVI, page 13. Final complaint §§46–48 and 57.
Section II exceptions preserve the five-year ban. Later violation proceedings can extend the overall twenty-year term. The settlement does not generally admit the allegations.
- When It Comes to Data Privacy, Consumers Must Be in the Driver’s Seat: Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement
California’s May 8 settlement announcement, proposed $12.75 million civil penalty and investigation findings.
Passages and scope
Background and requirements; proposed judgment §§30 and 40. Sales at issue cover 2020–2024.
The announcement makes the agreement subject to court approval. The published copy is marked proposed and has blank judicial signature lines. Reported $20 million sales proceeds are nationwide.
- The People of the State of California v. General Motors LLC and OnStar LLC : Complaint for Injunction, Civil Penalties, and Other Equitable Relief
Original complaint: Verisk and LexisNexis contracts, reported proceeds and insurer requests.
Passages and scope
Paragraphs 12–15, pages 6–7; paragraph 19, page 8. Filed May 8, 2026.
The authority’s allegations; complete private contracts remain outside the examined record. Verisk’s contractual exclusion of precise GPS retains identifiers and is not a technical audit of every delivery.
- Véhicules connectés : la CNIL publie sa recommandation sur l’utilisation des données de localisation
Final recommendation on connected-vehicle location data.
Passages and scope
60-page PDF: pages 4–5, 8–10, 13–28 and 57–59. Published June 30, 2026.
Private owners and lessees; employee vehicles are outside this document’s scope. Legal duties, recommendations and good practices are distinguished. Personal-data status depends on identifiability.
- Véhicules connectés : dans quelles conditions vos données de localisation peuvent être utilisées ?
Consumer explanation of collection limits, settings, profiles and changes of user.
Passages and scope
Collection limits, suggested tools, rights and practical steps; June 30, 2026.
Rights have legal conditions. Disabling a service requires attention to its effects on the relevant functions.
- Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
European guidelines, version 2 adopted March 9, 2021: local processing, ePrivacy and usage-based insurance.
Passages and scope
Pages 6–8, 18–20 and 27–29; paragraphs 13–16, 73–78 and 106–120.
Legal guidance rather than a survey of French insurers’ current practices. Consent for terminal access and the GDPR basis for subsequent processing require separate analysis.
- Guidance on vehicle data, accompanying the Data Act
Vehicle-data guidance accompanying the Data Act, C(2025) 6119 final, September 12, 2025.
Passages and scope
13-page PDF: §§4–8, 25–38 and 40–46; §29 on processing, §35(d) on scores.
Non-binding guidance. Chapter II covers readily available raw or preprocessed data; a simple calculation alone does not make data derived. Analysis creating new insights has different treatment.
- Data Act
Commission overview of the Data Act and its general application since September 12, 2025.
Passages and scope
Background, access rights and repair; page updated July 2, 2026.
The application date differs from this page’s update date. The Commission’s stated benefits are policy aims, distinct from observed price reductions.
- Personal data: what buyers actually pay for
Earlier l0g analysis of personal-data buyers and their contracts.
Passages and scope
GM, Verisk and LexisNexis section; published September 19, 2026.
Editorial continuity. Legal and contractual facts in this new article have been rechecked against primary sources.
- Attorney General James Secures $220 Million from General Motors for Selling Drivers’ Private Data
October 29, 2026 announcement of a $220 million settlement by a coalition of 36 attorneys general.
Passages and scope
Introduction, broker sales, dealership oversight and payments to participating states.
The enforcement authority’s announcement. The stated amount does not establish completed payment; S12 supplies the agreed schedule.
- Commonwealth of Pennsylvania v. General Motors LLC, General Motors Holdings LLC and OnStar LLC : Consent Petition for Final Decree et complaint, case 261004104
Official multistate settlement text: payment terms and planned timetable.
Passages and scope
Consent decree: page 1; §17, page 7; §§31–69, pages 9–28; §71, page 30; judicial signature lines, page 36.
The copy specifies a November 30, 2026 effective date and payment to the states within thirty days thereafter. Judicial lines are blank in the published document; no admission of facts or liability. The amount is not direct compensation to drivers.
- Based on customer feedback, GM is discontinuing Smart Driver
GM statement on ending sharing with LexisNexis and Verisk and discontinuing Smart Driver.
Passages and scope
April 24, 2024 release; partnership termination section; sharing said to have ended March 20.
GM’s account of its actions, distinct from independent technical verification of the shutdown.
- Regulation (EU) 2023/2854 (Data Act), Articles 1, 3–5 and 50
EU Data Act: scope, interaction with GDPR and the separate design timetable.
Passages and scope
Articles 1, 3–5 and 50; Official Journal, December 22, 2023.
General application from September 12, 2025; Article 3(1) applies to connected products and related services placed on the market after September 12, 2026. GDPR requirements remain relevant where the user and data subject differ.
This analysis is not investment advice.
// cite this analysis
l0g, “GM and OnStar: the trade in driving data”, l0g.fr, published October 31, 2026, updated October 31, 2026, https://l0g.fr/en/analysis/connected-car-data-insurance/
$ cd ../analysis