GM Driver Data Became an Insurance Input, but the Privacy Fix Stops at GM

GM driver data once flowed from connected vehicles to outside companies that helped insurers evaluate customers, despite drivers receiving little meaningful warning about that outcome.

The Federal Trade Commission has now finalized an order restricting that pipeline. GM faces a five-year ban on sharing covered location and driving behavior data with consumer reporting agencies. The order also requires clearer consent, access, deletion, and opt-out mechanisms for connected vehicle data.

The enforcement action matters, but it does not settle the larger dispute. Connected cars still collect detailed telemetry across the American auto market. The central conflict is now clear: automakers describe that information as necessary for useful services, while drivers lack comparable control over its secondary use.

GM is the immediate example, not the entire problem. Consumer Reports found that nearly every automaker selling cars in the United States collects and shares some form of driver behavior data. Mozilla previously gave all 25 brands in its automotive review failing privacy marks.

That gap creates the real story. Regulators have restricted one company after alleged harms became visible, yet the economic and technical system surrounding vehicle data brokers remains largely intact.

The GM Driver Data Pipeline Was Built Into a Helpful Feature

The most important change is that regulators treated GM driver data as sensitive information with consequences beyond the vehicle itself.

GM offered OnStar Smart Driver as a feature that helped customers assess their driving. Participants could review driving insights, track streaks, and receive badges based on their behavior.

Behind that consumer-facing experience, connected vehicles recorded events such as hard acceleration, hard braking, seat belt use, and speeds above 80 mph. The system associated those events with identifiers, timestamps, and precise location information.

According to the FTC’s complaint against GM, a vehicle task began collecting relevant information after ignition. It transmitted bundled driver behavior data to GM’s systems after individual trips.

GM then provided portions of that information to outside companies over time. The recipients named by the FTC included Verisk, LexisNexis Risk Solutions, Wejo, and Jacobs.

LexisNexis received information under an agreement that began in 2019. The transferred fields included a customer’s name, address, email address, vehicle identification number, trip identifier, timestamp, and triggering driving event.

This was not merely anonymized engineering telemetry moving through a research pipeline. Identifying details could accompany behavioral records into a consumer reporting system.

Consumer reporting agencies assemble information that businesses use when evaluating individuals. In this case, insurers could obtain reports containing vehicle-generated behavior and consider them when quoting or renewing coverage.

That downstream use changed the meaning of Smart Driver. A hard-braking event no longer served only as feedback inside an app. It could become one element in a profile used for a financial decision.

The FTC alleged that GM did not clearly explain this outcome when seeking enrollment. Consumers were told that the feature could collect location, speed, braking, acceleration, and other vehicle information to provide driving insights.

The agency also highlighted language saying the feature was not intended to assess compliance with driving laws or guidelines. That reassurance sat uneasily beside the transfer of driving events to companies serving insurers.

Consent becomes weak when the disclosed purpose differs from the practical consequence. A customer might accept behavioral tracking for coaching while rejecting its use in an insurance report.

The enrollment setting added another concern. GM sought OnStar acceptance while customers were completing the purchase or lease of a vehicle at a dealership. Buyers faced several screens involving connected services, privacy terms, and feature enrollment.

A contract link can provide legal notice without creating genuine understanding. Few buyers expect an optional dashboard score to help populate a report available to an insurer.

The collection could also become highly granular. The FTC said GM sometimes gathered precise location and driving behavior information as frequently as every three seconds.

That frequency can reveal more than isolated speeding or braking. A detailed sequence may reconstruct routes, routines, workplaces, medical visits, religious attendance, or trips involving another person.

GM ended its relationships with LexisNexis and Verisk in March 2024. The company later discontinued Smart Driver and removed the feature from its branded applications in June 2024.

However, the complaint says another data flow continued until April 5, 2024. That detail illustrates why a public announcement about ending selected relationships does not necessarily describe every active pipeline.

The regulator’s response converted those concerns into specific obligations. The final GM order requires consent and controls that reach beyond a revised privacy notice.

GM must let American consumers request their information and seek deletion. It must also ask previous recipients to delete covered driver data, subject to legal and regulatory exceptions.

Where vehicle technology permits, consumers must be able to disable precise location collection. People who decline or leave OnStar must also receive a way to stop remote collection, with defined safety and legal exceptions.

These requirements run for the order’s 20-year duration. The narrower prohibition on sharing covered data with consumer reporting agencies lasts five years.

The distinction matters. GM did not receive a general ban on collecting all connected vehicle information. The order instead targets consent, secondary use, consumer reporting, and a lack of practical controls.

That makes the enforcement action a boundary rather than a rejection of connected cars. Emergency response, theft alerts, diagnostics, and requested services still justify certain information flows.

The disputed behavior begins when data collected for one visible service quietly enters another commercial system. That is where a convenience feature can become a surveillance product.

Car Data Privacy Is Now an Industry-Wide Pressure Point

GM faces a binding order, but car data privacy problems extend across brands, applications, finance agreements, and outside service providers.

A modern vehicle produces information through navigation systems, microphones, cameras, driver-assistance sensors, infotainment software, and mechanical components. Mobile applications add account identifiers and remote commands to that stream.

Some collection supports functions drivers actively request. Location can help emergency responders find a crashed vehicle. Diagnostic readings can warn an owner about a mechanical failure before it becomes dangerous.

Automakers also use fleet information to analyze defects, improve software, and study road conditions. Those functions create legitimate reasons for connected vehicles to communicate with company servers.

The privacy problem appears when companies collect more than a specific function requires, retain it indefinitely, or disclose it for unrelated purposes. Drivers rarely see those decisions as they occur.

Consumer Reports examined thousands of pages of privacy policies and questioned 15 automakers, including Ford, Honda, Hyundai, Kia, Tesla, Toyota, Volkswagen, and GM. Its industry-wide investigation found driver behavior collection and sharing across almost the entire American market.

The organization reported that such information can reach multiple businesses. Potential uses include insurance pricing and online auto-loan offers.

The variety of data sources makes control unusually difficult. A driver may have separate relationships with the automaker, financing company, dealership, navigation provider, phone platform, insurance application, and roadside service.

Each relationship can present its own agreement. A customer who rejects one optional feature has not necessarily stopped information collected under another policy.

Vehicle ownership also involves people who never accepted any terms. Family members, passengers, employees, renters, and used-car buyers can enter a sensor-filled space tied to someone else’s account.

The owner may technically carry responsibility for informing them. In practice, occupants rarely receive a privacy notice before connecting a phone or sitting near an interior microphone.

Mozilla’s vehicle privacy review showed how broad the contractual claims can become. Every one of the 25 reviewed brands failed its minimum privacy standards.

Mozilla found that 84 percent could share personal data, while 76 percent said they could sell it. The policies referenced categories extending far beyond basic maintenance records.

Those percentages describe what privacy documents permit, not proof that every company sells every category it lists. Still, broad permissions weaken a customer’s ability to understand actual practices.

A privacy policy must cover many products, jurisdictions, and future uses. Companies often respond by writing expansive terms that preserve flexibility.

That approach shifts uncertainty onto the driver. Customers must assume that a permitted transfer might occur, even when they cannot determine whether it currently does.

The GM case demonstrates why that uncertainty matters. Driver behavior information had already moved into consumer reports before many affected people understood the connection.

Industry pressure now comes from three directions. Regulators are scrutinizing consent, lawmakers are debating ownership, and customers are demanding controls that resemble settings on phones.

Automakers cannot answer those demands with disclosure alone. A meaningful system needs collection limits, understandable categories, accessible controls, and records showing which outside companies received the information.

Drivers also need choices that do not disable unrelated safety functions. Turning off insurance-oriented tracking should not require surrendering emergency calling or essential diagnostics.

That separation presents a product-design challenge. Connected services often share identifiers, cloud infrastructure, permissions, and account systems behind the dashboard.

A single acceptance button may be convenient for enrollment. It is poorly suited to decisions involving location, behavioral scoring, marketing, research, insurance, and law enforcement.

Manufacturers are therefore pressured to redesign data governance alongside their interfaces. The key unit is no longer whether a driver accepted a privacy statement.

The relevant questions are more specific. What was collected, why was it required, how long was it retained, who received it, and what consequence followed?

Vehicle Data Brokers Turn Telemetry Into Financial Leverage

The primary conflict is between connected services that require operational data and vehicle data brokers that transform it into commercial leverage over drivers.

Data brokers sit between the original collection point and the company making a decision. They obtain information from multiple sources, organize it, and supply reports or analytical products to other businesses.

In the GM system, that intermediary role reduced visibility. A driver interacted with GM and OnStar, while an insurer could later receive information through a consumer reporting agency.

The chain divided responsibility across several companies. GM collected the events, a broker packaged them, and an insurer interpreted the resulting report.

That structure makes disputes harder to resolve. A customer questioning a premium increase must first discover that a vehicle report exists, identify its supplier, inspect the underlying events, and challenge inaccuracies.

Even accurate sensor readings can produce misleading conclusions. Hard braking might reflect a pedestrian entering the road, a traffic signal changing unexpectedly, or defensive action that prevented a collision.

Night driving can indicate shift work rather than recklessness. A speed threshold may also lack context about road type, an emergency, or another person using the vehicle.

Telematics does not understand motive. It converts physical signals into variables that another system can treat as indicators of risk.

That limitation does not make every usage-based insurance program unfair. A driver can knowingly install an insurer’s device or activate an application in exchange for a personalized assessment.

The crucial difference is informed participation. A direct program makes the insurer, collection purpose, and potential financial consequence visible before tracking begins.

The GM allegations described a more indirect arrangement. Customers encountered Smart Driver as a self-assessment feature, while their data could support reports delivered to insurers.

Senators Ron Wyden and Edward Markey later investigated similar relationships involving GM, Honda, and Hyundai. Their findings on automaker data payments showed how little direct revenue some transfers produced.

Verisk reportedly paid Honda $25,920 for information from 97,000 vehicles. That equals 26 cents per car, according to the senators.

The figure exposes an uncomfortable imbalance. A manufacturer can receive a modest payment while an individual driver faces a much larger financial consequence from the resulting report.

It also challenges the idea that data sales are essential to connected-car economics. The immediate revenue may be small compared with the privacy risk and reputational damage.

However, the long-term value of automotive data goes beyond a single payment. Detailed fleet information can support insurance products, advertising, mapping, vehicle development, credit decisions, and subscription strategies.

Automakers increasingly treat software and services as continuing relationships after a vehicle sale. Persistent data access helps companies measure use and develop recurring products.

That incentive will survive the GM order. The ruling constrains defined transfers by GM, but it does not eliminate the market demand for behavioral and location information.

Vehicle data brokers may adjust their sources, consent language, or product structure. Automakers may also describe sharing as a service partnership rather than a direct sale.

Privacy rules must therefore address function, not labels. A free transfer can produce the same consequence as a paid sale when the recipient uses it to evaluate a person.

De-identification offers another incomplete answer. Removing a name does not always make precise location safe, because repeated routes can reveal a home or workplace.

A vehicle identification number and account details can also reconnect records with an individual. Combining automotive information with other commercial datasets increases that possibility.

The stakes extend beyond insurance. Precise movement data can interest advertisers, lenders, litigants, law enforcement agencies, abusive partners, or criminals who gain unauthorized access.

Useful connected services and privacy are not natural enemies. The conflict arises from treating every available signal as a reusable corporate asset.

Automakers can process information locally when cloud transfer is unnecessary. They can also aggregate engineering statistics, shorten retention, and separate optional commercial uses from core operations.

Those choices may limit future business opportunities. They would also align the system with what drivers reasonably expect when buying transportation rather than a surveillance subscription.

The FTC Order Creates a Model With Important Gaps

The GM driver data order establishes practical protections, yet its company-specific scope leaves most connected-car owners outside the remedy.

The strongest part of the order is its operational detail. GM must do more than rewrite dense terms or add another link during enrollment.

Affirmative express consent requires a clear action tied to the collection, use, or disclosure at issue. Silence, continued vehicle use, or acceptance of unrelated terms should not substitute for that choice.

Access and deletion rights can also expose hidden data flows. A driver who receives a copy of a record can identify errors and understand the categories a company retains.

The requirement to contact previous data recipients addresses another common weakness. Deleting a manufacturer’s copy does little if brokers retain duplicates and continue supplying them elsewhere.

Location controls provide a further test. A dashboard toggle or comparable setting gives users a direct way to change collection without navigating a long privacy portal.

However, implementation will determine whether those protections work. A control is not meaningful if it disables essential services, resets after an update, or hides behind confusing menus.

Drivers will also need plain explanations of the exceptions. Safety communications, theft responses, legal duties, and consumer-initiated requests can still involve information collection.

The order does not give every American driver the same rights. It binds the named GM entities, while other manufacturers remain governed by their own policies and applicable state laws.

This asymmetry can distort competition. GM must invest in consent and deletion systems that rivals may avoid until another enforcement action reaches them.

It can also confuse consumers. A Chevrolet owner and a Toyota owner may encounter similar sensors but receive materially different controls and remedies.

The five-year sharing ban has limits as well. It applies to defined disclosures involving consumer reporting agencies, not every conceivable recipient or internal use.

After the prohibition ends, future practices will depend on the remaining order, other laws, and the design of any renewed data program. The 20-year obligations still impose substantial guardrails.

Another uncertainty concerns enforcement capacity. Regulators need technical access and reliable records to determine whether a complex vehicle platform follows its stated permissions.

Auditing a connected-car system involves more than reading a public policy. Investigators must map embedded software, mobile applications, cloud storage, vendors, brokers, and deletion procedures.

Automakers can help by maintaining machine-readable records of consent and transfer. They should document the purpose, recipient, fields, retention period, and legal basis for each flow.

Independent testing would make those records more credible. Consumers should not have to trust a dashboard message that cannot be compared with actual network behavior.

Federal legislation might standardize these expectations. The proposed federal privacy bill introduced in December 2025 would restrict manufacturers from accessing, selling, or sharing covered vehicle data without owner consent.

The proposal would also give vehicle owners access and control rights. Its introduction shows bipartisan-era interest in treating automotive data as a distinct policy problem.

Yet owner-focused rules raise their own questions. The owner is not always the driver, and neither person necessarily represents every passenger whose information enters the system.

A fleet company might own an employee’s vehicle. A rental company owns a car used by changing customers. A lender may retain an interest in a financed vehicle.

Effective legislation must define whose consent matters for each category. Location and biometrics deserve stricter treatment than aggregated component-health statistics.

Regulators must also prevent consent fatigue. Requiring approval for dozens of poorly explained data categories can turn a legal protection into repetitive button pressing.

Purpose limitation offers a clearer approach. Companies should collect information needed for a stated function and seek a new decision before using it for an unrelated outcome.

The industry will argue that overly rigid rules can obstruct safety research, cybersecurity, and product improvement. That concern deserves serious treatment.

Connected vehicles need rapid communication for recalls, emergency response, and vulnerability mitigation. Privacy requirements should preserve those defined functions while restricting secondary commercialization.

The GM case does not prove that all automotive data use harms consumers. It does show that a supposedly helpful feature can feed a consequential system without adequate understanding.

That is enough to reject broad, bundled consent as the default. The burden should sit with the company seeking another use, not the driver trying to uncover it later.

Drivers Still Face a Difficult Opt-Out System

Car data privacy depends on controls that ordinary drivers can find, understand, and use without becoming automotive privacy specialists.

Drivers can begin by checking the privacy settings in their vehicle and its associated mobile application. Relevant labels may mention connected services, driving analytics, insurance, personalization, or location sharing.

An optional driving-score feature deserves special attention. Customers should identify who receives its data and whether participation can influence insurance, financing, or marketing.

A driver can also submit an access request where state law or company policy provides one. The response may reveal stored identifiers, behavior records, location history, and categories of recipients.

Deletion requests are useful but should not be mistaken for permanent prevention. A system might begin collecting new information after deleting an existing record unless the user also changes permissions.

Broker reports require separate attention. Consumer reporting laws can provide rights to obtain a file and dispute inaccurate information when a company uses such a report.

Households should review every authorized driver and linked account. A former owner, family member, dealership employee, or expired mobile connection can leave permissions in an unexpected state.

Used-car transfers create another weak point. Sellers should remove paired devices, personal destinations, garage credentials, contacts, and account access before handing over a vehicle.

Buyers should perform a factory reset where appropriate, then verify the vehicle’s ownership status with the manufacturer. A reset inside the cabin may not erase server-side records.

These steps reduce exposure, but they do not solve the structural problem. Consumers cannot negotiate effectively when every practical new-car option includes extensive connectivity.

Opting out can also carry costs. Drivers may lose remote start, navigation updates, theft recovery, maintenance alerts, or other services bundled with the same account.

That design converts privacy into a product penalty. A better system would let drivers reject unrelated monetization while retaining the service that required the original information.

Dealerships have an important role because enrollment often occurs during a complicated purchase. Sales staff should explain optional tracking separately from financing, warranties, and essential vehicle delivery.

A privacy decision should never depend on a rushed tap between several contractual screens. Buyers need a later opportunity to revisit every permission.

Manufacturers can improve matters through a data dashboard. It should show active sensors, recent transfers, named recipient categories, retention periods, and the consequences of disabling each flow.

The dashboard should also distinguish local processing from remote collection. A camera that monitors attention without transmitting images creates a different risk from one uploading cabin footage.

Clear design would benefit automakers as well. It can preserve customer trust in connected safety features that otherwise become associated with undisclosed surveillance.

The remaining burden should not fall entirely on individuals. Drivers cannot inspect proprietary software, audit every vendor, or track changes across years of privacy policies.

Regulators and independent researchers must continue examining actual behavior. Public promises need comparison with network traffic, contracts, internal retention, and downstream products.

Three Signals Will Show Whether the Market Really Changes

The next test is whether the GM driver data case produces industry-wide limits or remains an isolated response to one exposed pipeline.

The first signal is enforcement against another automaker. Consumer Reports and Mozilla documented broader practices, while senators identified data relationships involving multiple manufacturers.

A second FTC case would strengthen the view that the GM order represents a general standard. No additional action would suggest that protections still depend on individual investigations and public controversy.

The second signal is progress on federal vehicle data legislation. A national rule could create consistent access, deletion, consent, and purpose limits across brands and states.

The details will matter more than the bill’s name. A weak opt-out can legitimize broad collection, while clear purpose limitations can prevent unexpected reuse before harm occurs.

The third signal is a visible product change inside vehicles. Drivers should watch for granular settings that separate emergency functions, diagnostics, analytics, insurance, marketing, and location history.

A real shift will be measurable through defaults. Optional commercial sharing should begin disabled, require a specific choice, and remain separate from basic connected services.

Automakers should also name recipient categories and preserve a transfer history. A generic statement about trusted partners cannot support informed control.

If these three signals appear together, the GM case will have changed the market. Enforcement would establish consequences, legislation would expand coverage, and product design would make rights usable.

If they do not, vehicle data brokers will retain substantial room to repackage the same information flows. Companies can revise language while leaving the underlying incentives untouched.

For drivers, the immediate task is to inspect connected-service settings and request available records. For policymakers, the larger task is to make those defensive steps unnecessary.

A car can use data to protect occupants, diagnose failures, and improve transportation without treating every trip as an open commercial resource. The decisive question is whether the industry builds that boundary before another insurance report exposes it.