Does Your Car Company Need Your Permission to Sell Your Driving Data? Where the Law Draws the Line After the GM/OnStar Lawsuits

October 20, 2026
Posted by AmyGinsburg

Your car collects data every time you drive it. That’s not new, and much of it is legal. The legal fight is over what happens next: whether a carmaker can take data about how fast you drive, how hard you brake and where you go, and sell it to companies that score drivers for insurers, without clearly asking you first.

That question is at the center of the lawsuit Montana Attorney General Austin Knudsen filed against General Motors and OnStar on October 16, 2026. Montana says GM never obtained drivers’ real consent. We covered the details of that complaint, the Texas lawsuit and the FTC’s 2026 order in our earlier article. This post answers the questions we’re hearing most often from drivers and reporters: where the legal line is, whether this is just a GM problem, and what you can do about it.

Collecting data vs. selling it: where the law draws the line

There is no single federal privacy law covering car data. The rules come from a patchwork of federal consumer-protection law, state privacy statutes and state deceptive-practices laws. Across that patchwork, a few principles are consistent:

Data used to run the car or the service you signed up for is generally allowed if it’s disclosed. Diagnostics, crash notification, roadside help, navigation and stolen-vehicle tracking all depend on vehicle data, and the law generally allows a company to collect it for those purposes when it tells you.
The “black box” belongs to you. Under the federal Driver Privacy Act of 2015, the data stored in a vehicle’s event data recorder belongs to the owner or lessee. With limited exceptions, such as a court order, no one else can retrieve it without the owner’s consent.
Selling data for an unrelated purpose is where consent really matters. Selling driving behavior to data brokers who build “driving scores” for insurers is not what most people think they’re agreeing to when they activate crash response or a mobile app. The FTC treats collecting sensitive data for one stated purpose and selling it for another, without clear disclosure and affirmative consent, as deceptive or unfair. That was the core of the FTC’s case against GM. Its final order, entered in January 2026, requires GM to get affirmative express consent before collecting, using or sharing connected-vehicle data, and bars GM from sharing geolocation and driving-behavior data with consumer reporting agencies for five years.
State privacy laws are raising the bar. About 20 states now have comprehensive consumer privacy laws. Many of them, including the laws in Texas, Tennessee, New Jersey and Montana, treat precise geolocation as “sensitive data” that generally can’t be processed without the consumer’s opt-in consent. California gives residents the right to know what’s collected, to have it deleted, to opt out of its sale and to limit the use of sensitive information. Maryland’s law goes further and prohibits selling sensitive data at all.

What counts as “real consent”?

Clicking “I agree” or signing a stack of papers at the dealership doesn’t automatically count as consent to have your driving data sold. Regulators and courts look at the substance, not just the signature:

Was the disclosure clear and specific, or was the key sentence buried deep in dozens of pages of terms?
Did the consumer actually understand that their driving behavior would be sold to third parties and could affect their insurance?
Did the consumer have a genuine choice, or was enrollment presented as a required step before driving off the lot?
Were people who tried to decline told something misleading, such as that safety features would stop working?

Those are the practices Montana alleges. According to the Attorney General, buyers went through an onboarding process that seemed mandatory, got more than 50 pages of OnStar disclosures that never said GM would sell their driving data, dealers were paid incentives to enroll customers, and customers who tried to decline were warned that safety features would be turned off. Montana sued under its Unfair Trade Practices and Consumer Protection Act, and Texas used its Deceptive Trade Practices Act in its 2024 suit. Every state has a consumer-protection law like these, so a state doesn’t need a special privacy statute to challenge a practice that misleads people. These are allegations. GM hasn’t had its day in court on the Montana claims.

Is this just a GM problem?

GM is the highest-profile case, but it isn’t the only automaker that has shared driving data. In 2024, Senators Ron Wyden and Ed Markey reported to the FTC that Honda shared data from about 97,000 cars with the data broker Verisk, and Hyundai shared data from about 1.7 million vehicles, without obtaining informed consent. According to the senators, Hyundai automatically enrolled drivers who turned on internet connectivity in a driving-score program without telling them their data would go to Verisk.

The problem is wider than any one brand. In 2023, the Mozilla Foundation reviewed the privacy practices of 25 major car brands, and every one received a failing grade. Modern cars collect data through sensors, apps, connected services and the phones paired to them, and every automaker has a business incentive to make money from it.

So for most drivers, the more useful question isn’t which brand they drive. It’s whether their data is being sold to companies that score their driving, and whether they ever really agreed to that.

7 steps to protect your privacy and your insurance rates

Request your consumer file. Companies that package driving data into reports for insurers can be consumer reporting agencies under the federal Fair Credit Reporting Act (FCRA). That means you have the right to see what they have on you. LexisNexis Risk Solutions takes consumer file requests online, and the CFPB keeps a list of specialty consumer reporting companies, including those that compile auto-insurance reports.
Don’t throw away insurance letters. If an insurer raises your rate, cancels your policy or denies coverage based even partly on a consumer report, the FCRA generally requires it to send you an adverse action notice that names the reporting company it used. That notice tells you where to look.
Dispute errors in writing. If a report shows trips you didn’t take, a car you didn’t drive or events that never happened, dispute it. The reporting company must investigate and correct or delete inaccurate information. If it ignores a valid dispute, the FCRA lets consumers sue for damages and attorney’s fees in the right circumstances.
Ask your automaker for your data, and turn off what you don’t want. Under the FTC order, GM must let any U.S. consumer request a copy of their data, ask that it be deleted, and opt out of geolocation and driving-behavior collection. Check your vehicle settings, the manufacturer’s app and any connected-services account, whatever brand you drive. Residents of California and other states with privacy laws can also send formal access, deletion and opt-out requests to any carmaker.
Slow down at the dealership. Before you activate connected services or any “driver feedback,” “smart driver” or “driving score” feature, ask exactly what data it collects and who receives it. If you want a usage-based insurance discount, sign up directly with your insurer so you know who has your data.
Keep records and shop around. Save your dealership paperwork, enrollment emails and insurance notices. If your premium jumped for no clear reason, ask your insurer in writing what information it relied on, and get quotes from other carriers.
Report it and get advice. You can file complaints with the FTC, your state attorney general and your state insurance department. A consumer-protection attorney can tell you whether an FCRA or state-law claim fits your situation.

Ginsburg Law Group helps consumers enforce their rights under the Fair Credit Reporting Act and state consumer-protection laws. If you think your driving data or an inaccurate consumer report raised your insurance rates or got you denied coverage, contact us for a review.

This article is for general informational purposes only and is not legal advice. The Montana and Texas cases involve allegations that have not been proven. Privacy and consumer-protection laws vary by state and change often. Consult a licensed attorney about your specific situation.