This post documents a data-collection practice and the privacy questions it raises. The key reporting comes from a New York Times investigation and the Federal Trade Commission’s action, linked throughout so you can verify every claim. Details are accurate as of publication on June 29, 2026. Company data practices and regulatory actions change quickly, so check the linked sources for the current picture.
Your car keeps a record of how you drive. Every hard brake, every fast acceleration, every late-night trip. On many newer vehicles that record does not stay in the car. It gets sent back to the manufacturer, sold to data brokers and passed on to insurance companies that use it to raise your rates. Most drivers never knowingly agreed to any of this.
This is not a worst-case hypothetical. It is what General Motors did, it got caught and it ended up paying for it.
What GM Did
GM ran a feature called OnStar Smart Driver. It collected detailed driving-behavior data, then shared it with data brokers LexisNexis Risk Solutions and Verisk. Those brokers sold the data to insurers, who used it to set rates. Drivers found out when their premiums jumped and they pulled their own broker reports to see why.
The story broke through a New York Times investigation in March 2024. Under the pressure that followed, GM discontinued Smart Driver in April 2024 and said it had ended its relationships with LexisNexis and Verisk.
The consequences kept coming.
- In January 2026, GM settled with the Federal Trade Commission. The order bars GM from selling driver-behavior data for five years. The FTC alleged GM used a misleading enrollment process to sign drivers up.
- In May 2026, California penalized GM over the same conduct. State officials said GM made roughly $20 million from the unlawful sale of customer data between 2020 and 2024, and that the information included names, location, driving behavior and contact details.
A misleading enrollment process is the key phrase. People did not knowingly sign up to have their driving sold to insurers. They were enrolled through a flow that obscured what was happening.
How the Car Collects It
Modern vehicles are full of sensors and a cellular modem. The car already measures speed, braking force, acceleration and steering for its own safety systems. The telematics system bundles that data with location and the vehicle identification number, then sends it back over the built-in connection. There is no aftermarket device involved and nothing plugged into the diagnostic port. The capability ships in the car.
That is what makes it hard to escape. You cannot decline the modem the way you can decline a phone app. Researchers at Mozilla, in their *Privacy Not Included project, rated cars the worst product category they had ever reviewed for privacy, precisely because of how much they collect and how freely it gets shared.
The Privacy Questions
Meaningful consent. Burying data-sharing inside a confusing enrollment screen is not consent. The FTC and California actions both turned on this. If you have to pull your own insurance-broker report to discover what your car has been sending, you were never given a real choice.
Location history. Driving-behavior data comes bundled with where you drove. That is the same sensitive location record at issue in cellphone tracking cases, generated by a device you cannot leave at home.
Rates set by a black box. When an insurer raises your premium based on broker data, you often cannot see the underlying record or challenge whether it is accurate. A single mislabeled “hard brake” event becomes a number on your bill with no clear way to dispute it.
No real opt-out. You can sometimes disable a named feature like Smart Driver, but the underlying collection capability is baked into the vehicle. The default leans toward collection, and the settings that limit it are buried where most owners never look.
What To Do
Until there are real limits on this, the practical steps are small but worth taking. Check your vehicle’s connected-services settings and turn off data-sharing features you do not want. Pull your own consumer report from LexisNexis to see whether your driving data is on file. Read what you are agreeing to when you activate a connected-car app.
The larger point stands on its own. A car is one of the most expensive things most people own, and it has quietly become a data-collection device that can be turned against your own wallet. GM got caught and paid. The collection capability is sitting in millions of other vehicles right now.
What You Can Do
Three practical steps you can take today.
Turn it off. Go into your vehicle’s connected-services settings or app and disable any driving-data or “smart driver” sharing. The wording varies by brand and it is usually buried.
See what they have. Request your own consumer report from LexisNexis Risk Solutions and from Verisk. You have the right to see what they hold, and it is the only way to know whether your driving has already been sold.
Read before you sign. Check what you are agreeing to when you activate a connected-car app or sign paperwork at the dealership. The consent for this is often hidden inside an enrollment flow.
Beyond your own car, support privacy rules that require real opt-in consent before a manufacturer can sell data it collects from a product you paid for.