Is Your Car Tracking You for Insurance? The OnStar Data Sharing Case

Your car kept a diary. Guess who read it?

In March 2024, The New York Times reported on a careful Chevrolet driver near Seattle who had never been responsible for an accident. In 2022, his car insurance jumped 21%. When he asked the data broker LexisNexis for his file, it came back with 258 pages. More than 130 of those pages listed 640 trips from the previous six months, each with start and end times, distance, hard braking events, and rapid acceleration. The trip data had been provided by General Motors (NYT, Mar. 11, 2024).

The trick: OnStar Smart Driver, a free feature contained within GM's connected car apps that promised driving feedback and digital badges for good driving. GM shared that driving data with two data brokers, LexisNexis Risk Solutions and Verisk, which then sold it to insurance companies. GM stopped sharing the data in March 2024 and later ended Smart Driver. In January 2026, the US Federal Trade Commission finalized an order banning GM and OnStar from sharing drivers' location and driving behavior data with consumer reporting agencies for five years (FTC, Jan. 2026).

If you drove a Chevrolet, GMC, Buick or Cadillac with OnStar between 2022 and March 2024, your driving data may be in a data broker file right now. Here's what happened, what you can do today, and how to check your own file.

#What happened with OnStar Smart Driver

OnStar Smart Driver was marketed as a way to get personalized feedback on your driving. The app promised tips, digital badges for good driving, and insights into your habits. It was free, and for many drivers, it felt like a harmless way to see how they compared to others.

Behind the scenes, the app was recording detailed trip data:

• Start and end times for every trip
• Distance traveled
• Hard braking events
• Rapid acceleration
• Speeding incidents

GM then shared that data with LexisNexis Risk Solutions and Verisk, two major data brokers that serve the insurance industry. Those companies used the trip logs to create risk scores, which they sold to insurance companies. The insurers used the scores to adjust premiums (NYT, Mar. 22, 2024).

The Chevrolet driver quoted at the top didn't know his data was being shared. When his insurance went up 21% with no accident, no ticket, and no obvious explanation, he requested his file from LexisNexis under the Fair Credit Reporting Act. That's when he saw the 640 trips. Each entry showed not just whether he drove, but how he drove, minute by minute.

#The FTC steps in

After the New York Times investigation and public backlash, GM stopped sharing the data in March 2024. By that point, LexisNexis and Verisk had already collected data on millions of drivers (TechCrunch, Jan. 14, 2026).

The FTC filed a complaint against GM and OnStar, alleging that they had collected and sold geolocation data and driving behavior without drivers' informed consent. The final order, settled in January 2026, includes these requirements (FTC final order, docket C-4828):

• Five-year ban on sharing covered driver data (location, hard braking, hard acceleration, speeding, seat belt use, late-night driving) with consumer reporting agencies like LexisNexis and Verisk
• Express consent required before any future sharing
• Deletion of data already shared with consumer reporting agencies, where feasible

The order applies to GM, OnStar and their affiliates. It does not cover other automakers, though the FTC's investigation may prompt those companies to review their own data sharing practices.

#How to check your LexisNexis file

If you had OnStar Smart Driver turned on at any point, or if you just want to see what driving data LexisNexis has on you, you can request a free consumer disclosure report. You're entitled to one free report every 12 months under federal law (Consumer Financial Protection Bureau).

#Step-by-step: request your LexisNexis consumer disclosure report

1. Go to consumer.risk.lexisnexis.com/request
2. Select Personal Reports
3. Choose LexisNexis Consumer Disclosure Report
4. Create an account or log in
5. Verify your identity (you'll answer questions based on your credit history and public records)
6. Submit the request

LexisNexis will mail your report to the address on file, usually within a few business days. The report shows what LexisNexis knows about you across multiple categories, including any driving or trip data they received.

#What to look for in your report

When your report arrives, scan it for sections labeled:

• Driving data
• Trip logs or trip history
• Vehicle location history
• Telematics data
• Auto insurance scores or risk scores

If you see trip logs like the ones described in the New York Times story (start/end times, distance, hard braking, speeding), those came from a connected car feature like OnStar Smart Driver.

#How to dispute errors

If your LexisNexis report contains driving data that's wrong, incomplete or shouldn't be there, you can dispute it for free under the Fair Credit Reporting Act. The report you receive includes instructions for disputes, along with contact information.

Common reasons to dispute:

• Trips you didn't take
• Data attributed to the wrong person
• Events (like hard braking) that didn't happen
• Data from a car you didn't own or drive

LexisNexis must investigate your dispute and correct or delete information that can't be verified.

#What this means for your insurance

Insurance companies use data from LexisNexis, Verisk and similar brokers to adjust premiums. If your report shows frequent hard braking, rapid acceleration or speeding, your insurer may classify you as a higher risk, even if you've never filed a claim or gotten a ticket.

If your car insurance rate went up between 2022 and 2024 with no obvious cause, and you had OnStar Smart Driver or a similar feature turned on, the data sharing could be one reason. Requesting your LexisNexis report lets you see what the insurers saw.

#Can I get my rate lowered?

That depends on your insurer. Some insurers will reconsider a rate increase if you can show that the underlying data was wrong or incomplete. Others treat telematics data as just one factor among many. If you find errors in your LexisNexis report, dispute them first, then contact your insurer with proof that the data was corrected.

#Other connected car features that may track you

OnStar Smart Driver is gone, but connected car features aren't. Many newer vehicles come with built-in connectivity, and most automakers offer companion apps that track location, driving behavior, maintenance and more.

Common features that may collect driving data:

• Telematics programs offered by your insurer (Progressive Snapshot, State Farm Drive Safe & Save, Allstate Drivewise)
• Connected car apps from the automaker (OnStar, FordPass, MyChevrolet, Toyota Connected Services)
• Third-party apps that connect to your car's OBD-II port or use your phone's sensors

Each of these features has its own privacy policy. Some share data with third parties, some sell it, and some keep it internal. Before you turn on any connected feature, read the privacy policy and the terms of service. Look for sections that say:

• Who gets your data (the automaker, insurers, data brokers, advertisers)
• Whether you can opt out
• How long they keep the data
• Whether they sell it

If you don't use a feature, turn it off in the app settings or disable it in your car's infotainment system.

#What the FTC order doesn't cover

The January 2026 FTC order against GM and OnStar is narrow. It only covers:

• GM, OnStar and their affiliates
• Sharing covered driver data with consumer reporting agencies (not all third parties)
• A five-year period starting from the order date

The order does not:

• Cover other automakers
• Ban all data collection by GM (only certain sharing)
• Delete data already sold to insurers (only data held by the consumer reporting agencies)
• Prevent GM from sharing data with third parties that are not consumer reporting agencies

In other words, the order is a significant step, but it's not a blanket ban on automotive data collection. Other automakers are still free to collect and share driving data, as long as they follow applicable privacy laws and their own disclosures.

#How to protect your driving privacy going forward

If you want to limit how much data your car collects and shares, here's what you can do:

1. Read your car's privacy policy. Look for it in the owner's manual, in the infotainment system settings, or on the automaker's website. Search for terms like "data collection," "telematics," "third-party sharing" and "opt-out."

2. Turn off connected features you don't use. Many features, like remote start or stolen vehicle tracking, require data collection. If you don't use them, disable them in the app or the car's settings.

3. Opt out of data sharing where possible. Some automakers let you opt out of certain data sharing in the app settings or on their website. Look for a "Your Privacy Choices" or "Do Not Sell My Personal Information" link.

4. Check with your insurer. If you enrolled in a telematics program like Progressive Snapshot or Allstate Drivewise, you can usually unenroll. Contact your insurer to ask how, and whether unenrolling will affect your rate.

5. Request your LexisNexis report once a year. Even if you've never used OnStar Smart Driver, LexisNexis may have other data on you from public records, credit applications or other sources. Check your report annually to see what's there and dispute anything that's wrong.

6. Use a privacy-focused mindset. Before you install any app, connect any device to your car, or turn on any "smart" feature, ask yourself: who gets the data, and is the convenience worth it?

#Why this matters

The OnStar Smart Driver case shows how data you thought was private, or at least limited to you and your car, can flow to data brokers and then to insurers, employers, marketers and others. The feature was marketed as a benefit, a way to become a better driver. For many users, it became a reason their rates went up.

The case also shows that data sharing often happens without meaningful consent. Many OnStar users didn't know their trip logs were being shared, or didn't understand what "personalized feedback" really meant in practice. When the New York Times asked GM about it, the company said drivers had consented by agreeing to the app's terms of service. The FTC disagreed, and so did many drivers (NYT, Mar. 22, 2024).

This isn't just about GM. Connected cars are everywhere now, and so are the apps, dongles and programs that promise to make you a safer driver or save you money. Some of them do. Some of them track you, score you, and sell your data to the highest bidder. The only way to know which is which is to read the fine print, request your data, and ask questions.

#Conclusion

If you drove a GM vehicle with OnStar Smart Driver between 2022 and March 2024, or if you use any connected car feature today, request your free LexisNexis consumer disclosure report. Look for trip logs, driving scores or vehicle data. If you find anything wrong, dispute it. If you find data you didn't expect, ask how it got there.

The FTC order is a start, but it's not the end. Other automakers collect similar data, other data brokers buy and sell it, and other insurers use it to set your rates. The best defense is to know what's being collected, read every disclosure, and opt out when you can.

UndoLeak erases your data from data brokers and keeps it off. If you want to see where else your personal information is listed, run a free scan.

#Related

How to Delete Your Phone from a Rental Car - Rental cars with infotainment systems can keep your texts, contacts, and call logs after you return them. Here's how to delete your phone data before the next renter sees it.

#Sources

1. The New York Times, Kashmir Hill, "Automakers Are Sharing Consumers' Driving Behavior With Insurance Companies" (March 11, 2024)
2. The New York Times, "General Motors Quits Sharing Driving Behavior With Data Brokers" (March 22, 2024)
3. TechCrunch, "The FTC's data sharing order against GM is finally settled" (January 14, 2026)
4. FTC, "FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers' Informed Consent" (January 2026)
5. FTC complaint and final order, docket C-4828
6. Consumer Financial Protection Bureau, "LexisNexis Risk Solutions"