General Motors (GM) is under legal scrutiny once again as Arkansas Attorney General Tim Griffin has filed a lawsuit against the automaker and its subsidiary, OnStar. The lawsuit, announced in late February, accuses GM of illegally selling driver data to third parties, including insurance companies, without proper consumer consent. This has allegedly led to increased insurance premiums and potential coverage denials for affected vehicle owners.
A Pattern of Data Monetization
The complaint claims that since 2015, GM has been leveraging its connected vehicle technology—such as myChevrolet, myCadillac, myGMC, and myBuick apps—to collect and sell driver data without explicit user approval. Unlike traditional insurance telematics programs that require drivers to opt in via a tracking device, GM allegedly harvested and distributed driving behavior data without obtaining clear consent from its customers.
Griffin argued that OnStar, initially marketed as a safety and navigation service, was instead being used as a tool for data monetization. “Consumers believed OnStar was enhancing their vehicle’s performance and security,” Griffin said in a statement. “Instead, their driving habits were being exploited for profit.”
In response to the allegations, a GM spokesperson told Consumer Affairs, “We are reviewing the complaint. GM remains committed to protecting consumers’ privacy.”
Mounting Legal Troubles for GM
This lawsuit adds to the growing legal pressure on GM regarding data privacy. In January 2025, the company settled with the Federal Trade Commission (FTC) over similar allegations. As part of the settlement, GM agreed to halt the sale of geolocation and driving behavior data for five years and to obtain explicit consumer consent before collecting such information in the future.
Additionally, GM is facing legal action in Texas, where Attorney General Ken Paxton filed a lawsuit in August 2024. That case alleges that GM sold driving data from more than 1.5 million Texans without their knowledge or approval. The lawsuit remains ongoing.
Beyond these state-led actions, GM is also contending with a sprawling multi-district litigation case involving 27 class-action lawsuits. These cases claim that GM’s data collection practices resulted in inflated insurance rates and that many vehicle owners were unaware their data was being harvested and sold. Plaintiffs argue that GM not only violated consumer privacy but also misled customers by failing to disclose how their data was being used.
What’s Next for GM?
The Arkansas lawsuit seeks financial compensation for affected drivers and legal injunctions to prevent further unauthorized data sales. If found guilty of deceptive trade practices, GM could face significant financial penalties and be forced to implement stricter data privacy measures.
For consumers, the case highlights growing concerns over how automakers handle connected vehicle data. As modern vehicles become increasingly reliant on digital systems, experts warn that transparency and consumer control over personal information will be crucial moving forward.
With lawsuits piling up and regulatory scrutiny intensifying, GM’s handling of consumer data could set a precedent for the auto industry. The outcome of these cases may shape how automakers approach data privacy and consumer consent in an era where connected vehicles are the norm.
