The automaker sold data acquired through its OnStar connected services to third party data brokers.
This data included information on driver’s location and on-road behaviour, as well as their name.
California is the first state to reach a settlement with GM, which could open the door to other lawsuits.
While connected services in cars bring about a wide range of features, such as over the air update capabilities, on-board navigation, and remote access via the driver’s phone, they also come with their share of cybersecurity risks.
If hackers gaining control of some vehicle features and data is a real possibility, something that fewer seem to consider is what automakers themselves do with the data their vehicles collect.
There are clearly some people who care about this issue, since General Motors has found itself in trouble in the United States over its treatment of driver data collected between 2020 and 2024.
A lawsuit in California, which was recently settled by the automaker, alleges that General Motors sold driving data to third parties without disclosing that information or obtaining consent from the involved drivers.
Specifically, the American automaker is said to have sold this data, which included the drivers’ names, contact information, GPS location, and driving behaviour, to data brokers Verisk Analytics Inc. and LexisNexis Risk Solutions.
As reported by Automotive News, these two companies reportedly intended to use this data to develop a driver rating system which auto insurers could use to set rates for individuals or specifics regions.
Cadillac VistiqHaving settled for $12.75 million, General Motors will be required to delete most driving data it collects after 180 days and ask Verisk Analytics Inc. and LexisNexis Risk Solutions to do the same.
While this is the first time a state settles with General Motors over data protection issues, the Federal Trade Commission (FTC) had already banned GM from sharing data collected from customer vehicles for five years back in January 2025.
For its part, General Motors, who is said to have made $20 million selling driving data, said in a statement that it is “[…] committed to being clear and transparent with our customers about our practices and the choices and control they have over their information.”.
Of course, the fact that General Motors was singled out in this lawsuit and last year’s FTC settlement doesn’t mean it is the only automaker to sell driver’s personal data. In fact, this could open to door to a number of additional lawsuits from other states and targeting multiple automakers.
As reported by Motor 1.com, General Motors was also sued by the State of Texas back in 2024 over data protection, along with Kia, Mitsubishi and Subaru.
Driver privacy will remain a hot topic as automakers keep adding more and more connected features to their vehicles.
Source: Automotive News and Motor1.com
