GM faces a five-year ban after the FTC said OnStar tracked drivers and sold location and behavior data without consent.
The Federal Trade Commission hit General Motors with a five-year ban on selling driver data to consumer reporting agencies and outside data brokers after saying GM collected and sold geolocation data without consumers' consent.
GM's OnStar service used a feature called Smart Driver to track things like speeding and nighttime driving, then shared that data with LexisNexis and Verisk, two companies that help insurers build risk profiles.
Some drivers said their insurance rates rose after that data collection, and many said they did not understand they had agreed to the tracking when they signed up for connected car services.
The bigger story for US drivers is that GM is not alone, because modern cars increasingly act like data-gathering devices on wheels, and regulators are only starting to catch up.
The Federal Trade Commission took the unusual step earlier this year of banning General Motors from selling customer driving data for five years. If you drive a connected car in the US, that matters because it tells you something uncomfortable but increasingly hard to ignore: your car may know far more about you than you think, and that information can end up shaping real-world costs like insurance.
Here's what happened. The FTC said GM, through its OnStar connected services business, collected detailed information including geolocation data and sold it to consumer reporting agencies and third-party data brokers, meaning outside companies that package and resell information. A feature called Smart Driver tracked behaviors such as how often someone sped or whether they drove at night, and GM then shared that data with LexisNexis and Verisk, both of which work closely with the insurance industry. The practical issue is not just that the data existed. It is that many drivers reportedly did not realize the extent of the tracking, even after signing up for an OnStar plan. Consent sat inside a confusing enrollment flow, according to reporting around the case, which is exactly the kind of design problem regulators increasingly treat as more than a paperwork issue.
That distinction matters in the US market because automakers have spent years repositioning cars as software platforms, subscription channels, and recurring-data businesses. Investors and executives like that model because it creates new revenue after the vehicle sale. Consumers usually hear about convenience features, safety alerts, and remote diagnostics. They hear much less about how behavioral data can travel to the insurance ecosystem. In GM's case, the consequences were concrete. A 2024 investigative report found that some drivers said their insurance rates went up after the data collection. That is the moment this stops being an abstract privacy debate and becomes a household-budget story. The FTC settlement forces GM to make it easier for drivers to turn off location tracking and to let them access and delete data the automaker collected. For a regulator that often gets criticized for moving too slowly on digital privacy, a five-year ban is a striking signal. My read is that Washington is starting to treat connected vehicles less like appliances and more like consumer surveillance systems with wheels, batteries, and a monthly services tab. There is a broader industry angle here that is easy to miss if you focus only on GM. The connected-car stack, meaning the bundle of software, sensors, apps, and subscription services inside modern vehicles, has become one of the auto industry's most valuable strategic bets. That same stack is also what turns routine driving into a stream of monetizable data points. Once that machinery is built, the pressure to find buyers for the data does not disappear on its own.
The Connected Car as a Surveillance Platform
The FTC’s unprecedented five-year ban on General Motors selling driver data is a structural reckoning for the automotive industry's most lucrative pivot. For the last decade, automakers have aggressively transitioned from hardware manufacturers to recurring-revenue software platforms, embedding telematics and connected services into every new chassis. However, GM’s decision to quietly monetize its OnStar "Smart Driver" behavioral data by packaging it for insurance risk brokers like LexisNexis and Verisk exposed a critical flaw in this business model: it transformed a consumer utility into a surveillance vector.
The Demise of Dark Pattern Consent
This regulatory action fundamentally alters the compliance landscape for connected vehicles. The FTC is directly attacking the industry-standard practice of burying broad data-sharing agreements within convoluted onboarding flows. By explicitly penalizing GM for consent gathering that ultimately spiked insurance premiums for unsuspecting drivers, Washington is establishing a hard boundary. Moving forward, behavioral data extraction requires explicit, granular, and easily revocable consumer consent, a requirement that will severely degrade the volume and commercial viability of these automotive data pipelines.
The Margin Threat to Auto SaaS
For the broader mobility and auto-tech ecosystem, this ruling represents a significant margin threat. Legacy automakers and EV startups alike have pitched Wall Street on a future subsidized by high-margin software-as-a-service (SaaS) and data monetization. If consumers increasingly equate connected vehicle features with predatory surveillance and higher household costs, the resulting trust deficit will trigger massive opt-out rates. Ultimately, the FTC has signaled that the automotive sector's recurring-revenue strategy cannot be quietly subsidized by the nonconsensual financialization of driver behavior.
Why should US drivers care about this now?
Because the business model is already ahead of the rules. In the US, car buyers have moved into an era where a vehicle purchase can quietly create an ongoing data relationship long after you leave the dealership. The car can know where you go, when you drive, and how you behave behind the wheel. If that information is routed into insurance scoring or third-party databases, the impact can show up as higher costs, fewer choices, or a privacy mess that is hard to unwind.
GM's case also lands at a time when regulators are paying closer attention to how companies obtain consent for data collection. A checkbox buried in an onboarding flow is no longer a harmless legal tactic if the practical effect is that people do not understand what they agreed to. The FTC's remedy, which includes easier tools to disable tracking and delete collected data, reflects a simple idea: controls only matter if ordinary people can actually find and use them.
There is also a competitive implication for automakers. US car companies and global brands selling into the US have been trying to build higher-margin software and services businesses as buyers push back on subscription fatigue. But if consumers start to equate connected features with hidden surveillance, that trust deficit can damage the very recurring-revenue strategy automakers are counting on. What looks like a data monetization win in the short term can become a product adoption problem later.
This is not happening in isolation. A 2024 investigation put public pressure on the driver-tracking and insurance pipeline by naming GM, LexisNexis, and Verisk. Then, in January 2026, the FTC finalized its order against GM. And now the issue is broadening into a more uncomfortable truth for the sector: GM may be the company under penalty, but the underlying incentive structure reaches much further than one automaker.
What to watch next
The first thing to watch is whether this stays a GM story or becomes an auto industry cleanup. The FTC order says GM has to change its controls and data practices, but the agency's action also gives regulators a roadmap for examining other connected-car programs. If enrollment flows are confusing elsewhere, or if location and driving behavior are being shared in ways consumers do not clearly understand, more scrutiny is likely.
Just as important, watch how automakers rewrite their privacy and services language for US buyers. When companies suddenly make it easier to opt out, simplify data settings, or separate safety features from behavioral tracking, that is usually not random product generosity. It often means legal and regulatory teams have concluded the old way of doing things will not hold up much longer.
For drivers, the immediate lesson is pretty plain. A connected car is no longer just a vehicle with an internet connection. It is part transportation product, part software service, and part data collection system. The FTC's move against GM does not settle that fight, but it does leave the industry with less room to pretend drivers knowingly signed up for all of it.
Frequently asked questions
Is my car really selling my driving data?
Yes, some connected-car services collect data such as location, speeding, braking, and nighttime driving, then share or sell it to outside companies. In this case, the FTC said GM's OnStar Smart Driver program collected and sold driver data without proper consent.
What did the FTC accuse GM of doing?
The FTC said GM collected precise geolocation and driving behavior data through OnStar and then sold that information to consumer reporting agencies and data brokers. Regulators said consumers were not given clear, meaningful consent for that data sharing.
What is OnStar Smart Driver and why is it controversial?
Smart Driver was an OnStar feature that tracked habits like speed, hard braking, and late-night driving. It became controversial because that data was allegedly shared with companies including LexisNexis and Verisk, which can influence insurance-related risk profiles.
Can car data affect my insurance rates?
Yes, driving data shared with consumer reporting or analytics firms can potentially shape insurance risk assessments and pricing decisions. Even if drivers never intended to enroll in a monitoring program, the data may still have downstream effects if it is sold or shared.
What does the FTC's five-year ban on GM actually mean?
The order bars GM for five years from sharing driver data with consumer reporting agencies and data brokers for those purposes. It is meant to stop the company from monetizing sensitive driver information while forcing stronger privacy and consent practices.
How can I protect my privacy in a connected car?
Start by reviewing your car app, infotainment settings, and any connected-service agreements to see what data collection is enabled. You can also opt out of telematics programs when available, disable unnecessary data sharing, and ask the automaker for a copy of its privacy policy.
