Driving data privacy lawsuits

Driving data lawsuits challenge the collection and sale of information about how, when and where people drive, data that reached car insurers without many drivers knowing. The main actions so far are a Federal Trade Commission order against General Motors and OnStar, finalized January 14, 2026; suits by the Texas and Arkansas attorneys general against GM and, in Texas, against Allstate and its data company Arity; and private class actions consolidated in federal court in Atlanta. Apart from the FTC order, the claims are allegations that courts have not resolved.

How the data moved from cars to insurers, with a full timeline and steps to request your files, is in connected-car data, data brokers and your premium. This guide covers the legal fight.

The cases at a glance

Sources: the FTC, the Texas and Arkansas attorneys general and the Judicial Panel on Multidistrict Litigation.

The FTC order against GM and OnStar

The FTC alleged that GM collected precise location and driving behavior, such as hard braking, hard acceleration and speeding over 80 mph, through its OnStar Smart Driver feature and sold it to consumer reporting agencies, which supplied reports to insurers. The Commission approved the final order 2-0 and described the conduct as an "egregious betrayal of consumers' trust."

The order:

• Bans GM and OnStar for five years from disclosing geolocation and driver behavior data to consumer reporting agencies.
• Requires affirmative express consent before collecting, using or sharing connected vehicle data, for 20 years, with limited exceptions such as emergency response.
• Requires a way for consumers to get a copy of their data and have it deleted, to turn off precise location collection where the vehicle allows it, and to opt out of location and behavior collection.

The order binds only GM and OnStar. It does not fine them, does not compensate drivers and does not apply to other automakers or to insurers. Compensation, if any, has to come from the private and state cases.

State attorney general suits

Texas v. GM (August 2024). Texas alleged that GM sold the driving data of more than 1.5 million Texans without their knowledge or consent.

Texas v. Allstate and Arity (January 2025). This case is different because it targets an insurer group and phone apps rather than a carmaker. Texas alleged that Arity paid app developers to embed its software in apps such as Life360, collected location data from more than 45 million people and that insurers used the data to justify higher premiums. Texas described it as the first enforcement action by a state attorney general under a comprehensive state data privacy law. See what driving apps collect and how insurers use it.

Arkansas v. GM (February 2025). Arkansas brought a deceptive trade practices case against GM and OnStar over the same Smart Driver data sharing.

State cases typically seek civil penalties and court orders changing company practices; penalties are paid to the state, not to individual drivers.

Private class actions

Drivers have filed class actions over the collection and sale of driving data. The federal Judicial Panel on Multidistrict Litigation consolidated them in the Northern District of Georgia as In re: Consumer Vehicle Driving Data Tracking Litigation, MDL No. 3115; the panel's October 1, 2026 report still listed it as pending.

The legal theories in cases like these typically include:

• Credit-reporting law. When a data broker compiles driving data into reports used for insurance decisions, the Fair Credit Reporting Act's accuracy, disclosure and permissible-purpose rules can apply.
• State privacy and consumer protection statutes. Claims that consent screens and privacy notices did not disclose the sale of data.
• Common-law privacy claims, such as intrusion upon seclusion and unjust enrichment.

Class actions face the hurdles described in class actions against car insurers: plaintiffs must show that common questions predominate, and damages can differ by person. No result in the multidistrict litigation had been announced as of October 2026.

Why insurers are in the middle

Insurers that bought data-broker reports were mostly customers, not defendants, in the GM cases. The Texas suit against Allstate and Arity is the main exception. Insurance regulation adds another layer: states, not the FTC, regulate how insurers use rating factors and underwriting data, and the FTC Act applies to insurance only to the extent states do not regulate it (see Why insurance is regulated by states, not Washington). Expect future rules on driving data in insurance pricing to come mainly from state legislatures and insurance departments.

Driving data you share knowingly through an insurer's own program is a different matter: you opt in and know who is scoring you. See usage-based car insurance explained.

What to do if you think your data was used

1. Request your consumer reports. LexisNexis Risk Solutions and Verisk both take consumer requests for reports that include driving data; the steps and contacts are in connected-car data, data brokers and your premium.
2. Keep any adverse action letter. If an insurer raised your price or refused coverage based on a consumer report, the letter must name the reporting agency. It is evidence in a dispute or a class claim.
3. Dispute errors in writing with the reporting agency and keep copies.
4. Turn off what you do not use. Review driving-score and location settings in your car's connected services and in phone apps.
5. Watch for a legitimate class notice. If a settlement is reached, notices will name the court and case number. Verify through the court before giving personal information, and note deadlines to file a claim or opt out.
6. Complain to regulators. Your state attorney general handles consumer protection; your state insurance department handles insurers' use of data.

Key takeaways

• The FTC's final order of January 14, 2026 bars GM and OnStar from giving driving data to consumer reporting agencies for five years and requires consent for 20 years, but pays nothing to drivers.
• Texas sued GM (2024) and Allstate and Arity (2025), and Arkansas sued GM (2025); these remain allegations.
• Private suits are consolidated in federal court in Atlanta as MDL No. 3115 and were still pending in October 2026.
• Credit-reporting, state privacy and consumer protection laws are the main legal tools.
• Request your LexisNexis and Verisk reports, keep any adverse action letter, and verify any class notice before responding.