Montana Sues GM and OnStar for Allegedly Selling Drivers’ Data to Insurers: How Your Car’s Driving Data Can Affect Your Insurance and What You Can Do

October 19, 2026
Posted by AmyGinsburg

If you drive a Chevrolet, GMC, Buick or Cadillac, your car may know more about you than you think: how fast you drive, when you brake hard, whether you buckle up and how often you’re on the road late at night. A new lawsuit says General Motors turned that information into a product and sold it.

On October 16, 2026, Montana Attorney General Austin Knudsen sued General Motors LLC and OnStar LLC in Montana’s First Judicial District Court in Lewis and Clark County (Case No. DV-25-2026-0000748-OC). The State claims GM violated the Montana Unfair Trade Practices and Consumer Protection Act by enrolling drivers in data collection without real consent and then selling their driving data to data brokers, who passed it on to car insurers.

Montana isn’t the first to sue. Texas filed a similar lawsuit in 2024, and the Federal Trade Commission finalized an order against GM and OnStar in January 2026. Here’s what’s alleged, what has already been ordered, and what you can do if you think your driving data was used against you.

What Montana claims

According to the complaint, GM began installing technology in its vehicles in 2015 that it advertised as improving safety and functionality. Montana alleges that the same technology also collected detailed “Driving Data” and that GM sold data from more than 14 million vehicles. The complaint lists dozens of data points, including:

current speed and GPS location
hard-braking and hard-acceleration events
driver and passenger seat-belt status
ignition on and off times
whether the car was going over or under 80 miles per hour.

Montana says GM’s contracts required the buyers of this data to build a “telematics exchange” and use it to calculate a “Driving Score” for each driver, based on factors such as late-night driving, sharp turns, hard braking and speeding. Those companies then licensed access to insurers. According to the complaint, insurers used the scores for decisions that included premium increases, dropped coverage and coverage denials.

The State also claims the enrollment process at dealerships was misleading. According to the Attorney General’s announcement, buyers were put through an onboarding process that seemed to be required before they could take the car. They got more than 50 pages of OnStar disclosures that never said GM would sell their driving data. Dealer employees were allegedly paid incentives to enroll customers, and drivers who tried to decline were allegedly told that safety features would stop working.

Montana is asking the court for a permanent injunction, civil fines, and an order requiring GM to delete all driving data, including data held by third parties. These are allegations. GM hasn’t had its day in court, and no court has decided whether the claims are true.

What the FTC has already required

In January 2025, the FTC accused GM and OnStar of using a misleading enrollment process and selling drivers’ geolocation and driving-behavior data to consumer reporting agencies without consent. According to the FTC, those agencies used the data in reports that insurers relied on to deny coverage and set rates. GM settled, and the FTC finalized the order on January 14, 2026. Under that order:

Five-year ban. GM and OnStar may not disclose drivers’ geolocation or driving-behavior data to consumer reporting agencies for five years.
Consent first. For the order’s 20-year life, GM must get drivers’ affirmative express consent before collecting, using or sharing connected-vehicle data, with limited exceptions such as emergency response.
Copies and deletion. GM must give every U.S. consumer a simple way to request a copy of their data and ask that it be deleted.
Turning it off. Drivers must be able to disable location-data collection (if the vehicle has the technology) and opt out of geolocation and driving-behavior data collection, with limited exceptions.
Cleanup. GM had to delete previously retained driving data (with exceptions for items like warranty, safety and legal matters) and ask the companies it shared data with to delete it too.

The FTC order doesn’t give drivers any money. The Montana and Texas lawsuits are state enforcement actions. Any civil fines they produce go to the states, not to individual drivers.

The state-by-state picture

Texas. In August 2024, the Texas Attorney General sued GM and OnStar in Montgomery County under the Texas Deceptive Trade Practices Act. Texas alleges GM collected and sold the driving data of more than 1.8 million Texans. Those claims are also allegations.

Other states. More states now have their own privacy laws. California’s Consumer Privacy Act gives residents the right to know what a business collects, to have it deleted and to opt out of its sale. Texas’s Data Privacy and Security Act gives Texans similar rights, but only the Attorney General can enforce it. New Jersey, Maryland and Tennessee have passed comprehensive privacy laws too. And every state has a consumer-protection statute that prohibits deceptive practices, which is the kind of law Montana and Texas are using against GM.

What this means for you

The federal Fair Credit Reporting Act (FCRA) is probably your most useful tool. When driving data is packaged into a report that insurers use, the company that compiles it may be a consumer reporting agency. That gives you rights:

Ask for your file. You have the right to request the information a consumer reporting agency keeps on you. The CFPB keeps a list of specialty consumer reporting companies, including ones that compile auto-insurance reports. LexisNexis Risk Solutions, for example, takes consumer file requests online.
Watch for adverse-action notices. If an insurer raises your rate, cancels your policy or denies coverage based in whole or in part on a consumer report, the FCRA generally requires it to tell you and to name the reporting company it used. Don’t throw that letter away.
Dispute errors. If a report contains inaccurate information (trips you didn’t take, a car you didn’t drive, events that never happened), you can dispute it. The reporting company generally must investigate, and inaccurate information must be corrected or deleted.
Ask GM for your data. Under the FTC order, GM must let you request a copy of your driving data and ask that it be deleted. Check your vehicle settings and the OnStar/myGM app to make sure location and driving-behavior collection is set the way you want.
Keep records. Save your dealership paperwork, OnStar enrollment emails and any insurance notices. If your premium jumped for no clear reason, those records may matter.

If a reporting company ignores a valid dispute, or an insurer used inaccurate data against you, the FCRA lets consumers sue for damages and attorney’s fees in the right circumstances.

Ginsburg Law Group helps consumers enforce their rights under the Fair Credit Reporting Act and state consumer-protection laws. If you think inaccurate driving or credit data raised your insurance rates or got you denied coverage, contact us for a review.

This article is for general informational purposes only and is not legal advice. The Montana and Texas cases involve allegations that have not been proven. Laws vary by state. Consult a licensed attorney about your specific situation.