Skip to content

Your Car Is a Surveillance Device: The GM OnStar Data Scandal

GM tracked your location every 3 seconds and sold it to insurance companies. The FTC just banned them. But only for 5 years.

By THEYDIDNTASK

TL;DR

  • —GM's OnStar service, marketed as a "safety feature," collected precise geolocation, driving behavior, trip history, and engine diagnostics and sold that data to LexisNexis, Verisk, and other data brokers, while GM claimed users had consented through the terms of service.
  • —The FTC disagreed, finding that GM failed to obtain affirmative informed consent before selling driver data.
  • —GM's "Smart Driver" program was particularly insidious, and GM discontinued it in April 2024 after the investigation began.

General Motors

In January 2025, the Federal Trade Commission (FTC) banned General Motors from selling driver location and behavior data to data brokers for five years.

Not because GM decided to respect privacy. Because they got caught.

What GM Was Doing

GM's OnStar service—marketed as a "safety feature"—was collecting and selling:

  • Precise geolocation data (every 3 seconds)

  • Driving behavior (speeding, hard braking, acceleration)

  • Trip history (where you went, when, how long you stayed)

  • Engine diagnostics (how you treat your vehicle)

This data was sold to:

  • LexisNexis — A data broker that compiles "consumer risk profiles"

  • Verisk — An insurance analytics company

  • Other third-party data brokers

The "Consent" Problem

GM claimed users consented through the terms of service. The FTC disagreed:

  1. Buried disclosures — Data sharing terms were hidden in lengthy privacy policies

  2. Confusing opt-in flows — Users thought they were enabling safety features, not surveillance

  3. No clear opt-out — Disabling data collection required navigating complex menus

  4. Continued collection after "opt-out" — Some data was still transmitted

The FTC found that GM failed to obtain affirmative informed consent before selling driver data.

The "Smart Driver" Trap

GM's "Smart Driver" program was particularly insidious:

  1. Marketed as a discount program — "Drive safely and save on insurance!"

  2. Actually a data harvest — Every trip uploaded to GM's servers

  3. Shared without clear disclosure — Data sold to insurance analytics firms

  4. Used to raise premiums — Insurers could increase rates based on collected data

GM discontinued Smart Driver in April 2024—after the investigation began.

What the FTC Settlement Requires

The settlement bans GM and OnStar from:

  • Selling geolocation and driving behavior data to consumer reporting agencies (5 years)

  • Failing to obtain explicit consent before collecting connected vehicle data

  • Misrepresenting data collection practices

GM must also:

  • Allow customers to access and delete their data

  • Provide mechanisms to disable geolocation and behavior tracking

  • Implement a full privacy program

The Bigger Picture

GM isn't alone. The entire automotive industry treats your car as a data collection device:

  • Tesla — Cameras record interior and exterior, fleet data shared

  • Ford — Patents for in-car advertising based on driving patterns

  • Toyota — Connected services collect trip and diagnostic data

  • Every modern car — Cellular uplinks transmit data to manufacturers

A 2023 Mozilla study found that 25 car brands (100% of those studied) collected more data than necessary, and only 2 allowed users to delete their data.

Defense Protocol

  1. Read the connected services agreement before activating any features

  2. Decline "Smart Driver" or similar programs — The discount isn't worth the surveillance

  3. Disable cellular connectivity if possible (may void warranty or disable features)

  4. Check settings regularly — Manufacturers add data collection in OTA updates

  5. Consider an older vehicle — Pre-2015 cars have fewer connected features

Your car knows where you live, where you work, where you worship, and who you visit. And until the FTC stepped in, GM was selling that information to anyone willing to pay.

Sources