Drivers of General Motors vehicles equipped with OnStar now have a federal order protecting their location data from being sold to insurance companies. The Federal Trade Commission finalized a settlement in January 2026 that bans GM and OnStar from collecting and selling geolocation and driving behavior data without informed consent for five years. The case, filed under Matter No. 2423052 and Docket No. C-4828, centers on allegations that GM harvested precise location information from connected cars and funneled it to third parties, including data brokers serving the insurance industry, all without telling drivers what was happening to their data.
Why the five-year data ban changes the calculus for GM and connected-car privacy
The FTC’s final order does more than punish past behavior. It strips GM and OnStar of the ability to treat driver data as a revenue stream for at least five years unless they secure clear, affirmative consent from each vehicle owner. That restriction lands at a moment when automakers across the industry have been racing to monetize data generated by connected vehicles, from trip routes and braking patterns to how long a car idles in a parking lot. By shutting down the external sale of this information, the FTC’s final decision forces GM to find other ways to extract value from the data its vehicles generate.
One plausible direction: GM could accelerate its own usage-based insurance offerings, keeping driver data in-house rather than sharing it with outside insurers or analytics firms. The company has already explored insurance-adjacent products through OnStar, and a ban on external sales does not prevent internal use under a consent framework. If GM builds or expands a first-party insurance product, it could retain the economic upside of behavioral driving data while technically complying with the FTC’s restrictions. The five-year window gives GM enough time to develop such a product without competitive pressure from rivals who might still be selling raw data externally.
The order also creates reputational incentives. GM has to reassure drivers who may now wonder how much of their past driving history was collected and where it went. Demonstrating a visible shift toward privacy-by-design-such as clearer dashboards for data permissions or easy opt-out tools-could help the company rebuild trust while still enabling connected features that depend on some level of tracking.
For drivers, the immediate effect is straightforward. If you own or lease a GM vehicle with OnStar, the company cannot share your precise location or driving habits with insurers or data brokers unless you explicitly agree. That is a significant shift from the prior arrangement, where, according to the FTC’s allegations, consent was either buried in dense terms-of-service language or not meaningfully obtained at all. The order effectively turns what had been a largely invisible data pipeline into something that must be disclosed in plain language and accepted on purpose, not by default.
How the FTC built its case against GM and OnStar
The enforcement action began with a proposed order the FTC announced in early 2025, alleging that GM and OnStar collected and sold geolocation data without consumers’ informed consent. The agency’s complaint described a system in which OnStar-equipped vehicles transmitted precise location coordinates and driving behavior metrics to GM, which then made that information available to third-party data brokers. Those brokers, in turn, supplied the data to insurance companies that used it to adjust premiums or make coverage decisions.
The proposed order was published in the Federal Register as 90 FR 8528 on January 30, 2025, opening a public comment period. During that period, consumer advocates, industry groups, and individual drivers had the opportunity to weigh in on whether the proposed remedies were sufficient and how they might affect the broader connected-car ecosystem. After reviewing those comments, the Commission approved the final order in January 2026. The official case docket now lists the matter’s status as “Under Order,” meaning GM and OnStar are legally bound by its terms and subject to additional penalties if they violate them.
The core legal theory rested on a simple premise: drivers who signed up for OnStar services, or who bought vehicles with OnStar pre-installed, did not receive clear notice that their second-by-second location data would be packaged and sold to companies that could use it against them financially. The FTC treated this as a deceptive practice, arguing that reasonable consumers would not expect their car to function as a real-time surveillance tool feeding data to their insurance provider. This framing allowed the agency to proceed under its traditional deception authority rather than relying on newer or more contested privacy statutes.
The order requires GM and OnStar to give consumers meaningful control over how their data is collected and used. That includes obtaining affirmative express consent before sharing precise geolocation or detailed driving behavior with third parties, as well as providing simple mechanisms to revoke that consent. It also bars the companies from treating OnStar as a consumer reporting agency for insurance purposes, a designation that would have allowed broader data sharing under different regulatory frameworks. These remedies go beyond a simple fine or slap on the wrist. They restructure how GM can operate its connected-vehicle data pipeline for the next half decade, effectively turning privacy safeguards into an operational constraint that product and business teams must work around.
Gaps in the record and what drivers should watch next
Several questions remain unanswered by the public docket. The FTC’s filings do not disclose how many vehicles or drivers had their data collected and shared. GM sells millions of vehicles annually in the United States, and OnStar has been a standard or optional feature across most of its lineup for years, but the exact scope of the data-sharing program is absent from the record. The names of the insurance companies or data brokers that received the information are also not identified in any public document tied to the case, leaving drivers to guess which firms might have access to their historical driving profiles.
GM’s internal revenue from selling driver data remains undisclosed as well. Without knowing how much money the company earned from these arrangements, it is difficult to gauge whether the five-year ban represents a major financial setback or a relatively modest course correction. The absence of dollar figures also makes it harder for policymakers to assess whether similar enforcement actions would meaningfully deter other automakers that might be running comparable programs.
For individual drivers, the most practical next step is to review the privacy settings in their vehicle and any associated mobile apps. Under the order, GM must present clearer explanations of what data is collected and how it may be used, particularly when it comes to location and behavior that could influence insurance decisions. Paying attention to new consent prompts, emails, or in-dash notifications over the coming months will help drivers understand what choices they are being asked to make and how those choices relate to the FTC settlement.
Regulators and advocates, meanwhile, will be watching how rigorously GM implements the order’s requirements. The settlement does not ban all data collection by OnStar; instead, it demands transparency and meaningful choice. That leaves room for GM to design consent flows that are technically compliant but still nudge drivers toward agreeing. Future disputes may hinge on whether those design choices respect the spirit of informed consent or merely satisfy its letter.
The case also raises broader policy questions that extend beyond GM. As more vehicles become rolling computers, the line between necessary telemetry and opportunistic surveillance grows blurry. The FTC’s action signals that at least one federal regulator is prepared to treat undisclosed location-sharing as a serious violation, not just a minor paperwork issue. Whether other agencies-or lawmakers-follow with sector-wide rules for connected cars could determine whether this settlement becomes a one-off cautionary tale or the template for a new era of automotive privacy.
For now, the message to GM drivers is clear: their location and driving data cannot be quietly packaged and sold into the insurance ecosystem without their say-so. The unanswered questions about past practices and financial impact remain, but the rules for the next five years are on the record, and both the company and its customers will be living with their consequences every time an OnStar-equipped vehicle hits the road.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
