A lawsuit filed by the state of Iowa has placed General Motors under renewed scrutiny over how it collects and uses driver data through its OnStar platform. The complaint, led by Iowa Attorney General Brenna Bird, alleges the automaker collected detailed driving information and shared or sold it to third parties, including insurers, without adequately informing customers.
The case centers on claims that some drivers did not realize their behavior, such as speed, braking patterns, and location, could be tracked and monetized. Iowa further alleges that insurance companies could use this kind of data to adjust underwriting decisions, including premiums or coverage status, depending on the insurer and the circumstances.
Filed in Polk County District Court, the lawsuit accuses GM of violating consumer protection laws and engaging in deceptive business practices. It also reflects broader concerns about how modern vehicles, increasingly connected and software-driven, collect and share personal data.
Allegations of Undisclosed Data Collection and Sale
At the core of the lawsuit is the claim that GM collected extensive driving data from vehicles equipped with OnStar systems, with Iowa alleging the practice dates back to at least 2015. The state says this included metrics such as speed, seatbelt use, acceleration, braking behavior, and location data. See the state’s announcement and case materials here: Iowa Attorney General release.
Iowa alleges this information was provided to third parties, including data brokers such as Verisk and LexisNexis Risk Solutions, which can make data available to insurers. The state further alleges that insurers used these driver-risk signals in underwriting decisions that could affect premiums or coverage outcomes.
The lawsuit also claims that GM did not clearly disclose these practices to consumers, and that some customers were led to believe enrolling in OnStar was necessary to access certain safety features, raising questions about whether consent was fully informed.
State officials argue that the alleged lack of transparency violates the Iowa Consumer Fraud Act, accusing the company of misleading buyers about how their data would be used.
Legal Pressure Builds Amid Federal Scrutiny
The Iowa case is not unfolding in isolation. It follows a series of legal and regulatory challenges tied to GM’s data practices, including action by the Federal Trade Commission.
On January 14, 2026, the FTC finalized an order restricting GM and OnStar from sharing consumers’ geolocation and driver-behavior data with consumer reporting agencies for five years. The FTC also said the order requires GM to obtain affirmative express consent for certain data collection/sharing and to provide consumers with options related to access, deletion, disabling geolocation collection (where supported), and opting out.
That federal action stems from similar allegations: that GM used a misleading enrollment process and did not adequately disclose how geolocation and driving behavior data would be collected and sold.
In addition to Iowa, other states and private plaintiffs have filed lawsuits raising comparable claims, and related proposed class actions have been consolidated into multidistrict litigation in federal court.
Iowa’s lawsuit seeks civil penalties, restitution for affected consumers, and an order requiring GM to delete previously collected data and stop further sale or sharing of the covered information, according to the state’s filing announcement.
Broader Implications for Connected Vehicle Data
The case underscores a growing tension in the automotive industry. Connected vehicle services like OnStar have become central to automakers’ strategies, offering features such as emergency assistance, navigation, and remote diagnostics.
However, these systems also generate large amounts of behavioral data, and regulators argue that drivers must be clearly informed about what data is collected, how it is used, and with whom it is shared.
GM has said it is reviewing the complaint and maintains that it is committed to protecting customer privacy, according to reporting on the Iowa filing. The company has also said it discontinued its Smart Driver program and ended certain third-party telematics relationships in response to customer feedback.
As vehicles become more connected, the outcome of this case could help define the boundaries of data use in the automotive sector. For consumers, it raises a central question: whether the convenience of smart vehicle features comes at the cost of personal privacy.