GM OnStar Data Privacy Lawsuits & $12.75M CA Settlement

Q: What is the GM OnStar class action MDL?

In re: Consumer Vehicle Driving Data Tracking Litigation, MDL No. 3115 (Case No. 1:24-md-03115-TWT), consolidates dozens of class action lawsuits in the U.S. District Court for the Northern District of Georgia. Plaintiffs allege GM, OnStar, LexisNexis Risk Solutions, and Verisk collected and monetized driving data from roughly 16 million drivers without consent. These are unproven allegations; no class has been certified.

By Steve Levine

Published: June 12, 2026

▼ Allegations Only · No Consumer Settlement Yet

This article covers a state enforcement settlement and a pending federal class action. The class action statements below are unproven allegations. General Motors has not been found liable in the federal litigation, no class has been certified, and there is nothing for consumers to claim at this time. This page is informational and is not legal advice.

Status Federal MDL Pending — No Consumer Settlement California's separate $12.75M enforcement settlement was announced May 8, 2026

California Penalty $12.75 Million Largest CCPA penalty to date · paid to the state, not to drivers

Can I Claim? No — nothing to claim yet The class action MDL for ~16 million drivers has no settlement or claim form

What Is This About?

General Motors is facing fallout on two fronts over its OnStar "Smart Driver" program, which allegedly collected detailed driving behavior data — acceleration, hard braking, speeding, distance traveled, and trip information tied to drivers' names and VINs — and sold it to data brokers that scored drivers for the insurance industry.

First, on May 8, 2026, California Attorney General Rob Bonta — joined by the California Privacy Protection Agency and the district attorneys of Los Angeles, San Francisco, Napa, and Sonoma counties — announced a $12.75 million settlement with GM over the alleged sale of hundreds of thousands of Californians' location and driving data to LexisNexis Risk Solutions and Verisk Analytics between 2020 and 2024. It is the largest penalty ever assessed under the California Consumer Privacy Act. The money goes to the state as civil penalties; California drivers do not receive payments from it.

Second, a nationwide federal class action — In re: Consumer Vehicle Driving Data Tracking Litigation, MDL No. 3115, Case No. 1:24-md-03115-TWT (N.D. Ga.) — is proceeding in the U.S. District Court for the Northern District of Georgia on behalf of roughly 16 million drivers. That case is still in litigation: there is no settlement, no claim form, and nothing for consumers to do right now.

The Smart Driver Data-Selling Allegations

OnStar Smart Driver was marketed as a feedback feature that helped GM owners track and improve their driving habits. According to the lawsuits and the California enforcement action, many drivers were enrolled through a rushed dealership sign-up flow or confusing in-app prompts without understanding that their driving data would leave GM at all. The New York Times first reported in 2024 that GM was sharing Smart Driver data with data brokers, and that some drivers saw their insurance premiums jump after insurers obtained driving-score reports built from their own cars' telemetry.

The consolidated federal complaint alleges that GM, OnStar, LexisNexis Risk Solutions, and Verisk Analytics collected and monetized this data without proper consent, asserting claims under the federal Wiretap Act, the Stored Communications Act, the Fair Credit Reporting Act, state privacy statutes, and common-law privacy and unjust-enrichment theories. As with any complaint, these are allegations only — a court has not found any defendant liable, and the companies are entitled to defend the claims. GM announced in 2024 that it had discontinued Smart Driver and ended its data-sharing arrangements with LexisNexis and Verisk.

GM also separately settled with the Federal Trade Commission: in January 2026 the FTC finalized an order barring GM and OnStar from disclosing drivers' geolocation and driving behavior data to consumer reporting agencies for five years and requiring opt-in consent for future collection.

What the $12.75M California Settlement Requires

Under the settlement announced by the California Attorney General — which resolves alleged violations of the CCPA and California's Unfair Competition Law, and marks the state's first enforcement action under the CCPA's data minimization and purpose limitation requirements — GM must:

• Pay $12.75 million in civil penalties to the state and partner agencies
• Stop selling driving data to any consumer reporting agency, including LexisNexis and Verisk, for five years
• Delete retained driving data within 180 days (except for certain limited internal uses) absent affirmative, express consumer consent, and request that LexisNexis and Verisk delete the data they received
• Build and maintain a privacy program that assesses and documents the risks of collecting data through OnStar, with compliance reporting to the Attorney General, the district attorneys, and the California Privacy Protection Agency

According to the Attorney General's office, GM made roughly $20 million nationwide from the data sales to LexisNexis and Verisk. The state's investigation also found that GM's privacy policy stated it did not sell driving or location data, and that California drivers were not hit with higher premiums as a result of the sales — California insurance law prohibits insurers from using driving data to set rates — unlike drivers in other states.

This is a government enforcement action, not a class action payout. There is no claim form, and no consumer — in California or elsewhere — receives a check from this settlement.

The Nationwide Class Action MDL (16 Million Drivers)

After the 2024 reporting, more than two dozen class action lawsuits were filed across the country. In June 2024, the Judicial Panel on Multidistrict Litigation centralized them before Judge Thomas W. Thrash, Jr. in the Northern District of Georgia as MDL No. 3115. (Our MDL explainer covers how multidistrict litigation works.)

The case cleared a major hurdle on April 22, 2026, when Judge Thrash issued a 200-plus page order largely denying the defendants' motions to dismiss. The order allows the federal wiretap and Stored Communications Act claims at the heart of the case to proceed, along with the unjust-enrichment claim and many state-law privacy, civil-conspiracy, and Fair Credit Reporting Act claims, while narrowing some others. Surviving a motion to dismiss means the allegations were plausible enough to litigate — it is not a ruling that they are true.

The MDL now moves into discovery, with class certification briefing to follow. Cases of this size typically take years to resolve, whether by trial or settlement.

Is There a Settlement or Claim Form Yet?

No. For the federal class action:

• There is no settlement fund.
• There is no claim form.
• There is no payout, and no deadline to act.
• Drivers do not need to do anything to "join" at this stage.

If the MDL eventually settles, a court-supervised claims process with its own eligibility rules and deadlines would be announced separately, and we will cover it here. LexisNexis — one of the data brokers in this case — has already paid out in a related consumer case: see the LexisNexis deceased-reports FCRA settlement for an example of a data-broker case that reached the claims stage.

Who Could Be Covered?

Because no class has been certified, no class definition is final. Based on the consolidated complaint, the people most likely to be covered if the case advances are owners and lessees of GM vehicles (Chevrolet, GMC, Buick, Cadillac) whose driving data was collected through OnStar or Smart Driver and shared with LexisNexis or Verisk — a group plaintiffs estimate at roughly 16 million drivers. GM drivers can check whether a LexisNexis or Verisk consumer file exists on them by requesting their free consumer disclosure report from each company, which is also a sensible way to preserve a record.

What Happens Next?

With the dismissal order behind it, the MDL proceeds through fact discovery, expert work, and class certification briefing — each step measured in months. The California settlement still requires court approval, and its injunctive terms (the five-year data-sale ban and deletion requirements) will reshape how GM handles connected-car data regardless of how the federal case ends. State attorneys general have been increasingly active on data privacy — see the Texas AG's data privacy suit against Netflix for another example.

OpenClassActions.com will watch the docket for major developments — class certification, summary judgment, or a settlement with a claim form — and update this page as the case advances.

Frequently Asked Questions

Do GM drivers get money from the $12.75 million California settlement?

No. The $12.75 million is a civil penalty paid to California enforcement agencies, not a consumer settlement fund. There is no claim form and no consumer payout from the state settlement. The separate federal class action MDL could eventually produce a consumer claims process if it settles, but it has not.

What is the GM OnStar class action MDL?

In re: Consumer Vehicle Driving Data Tracking Litigation, MDL No. 3115 (Case No. 1:24-md-03115-TWT), consolidates dozens of class action lawsuits in the U.S. District Court for the Northern District of Georgia. Plaintiffs allege GM, OnStar, LexisNexis Risk Solutions, and Verisk collected and monetized driving data from roughly 16 million drivers without consent. These are unproven allegations; no class has been certified.

What data did GM allegedly sell?

The lawsuits and the California Attorney General allege that GM's OnStar Smart Driver program collected driving behavior data — acceleration, hard braking, speed, distance traveled, trip and location information tied to names and VINs — and sold it to data brokers LexisNexis Risk Solutions and Verisk, which built driver scores used by insurers. GM has not been found liable in the federal litigation.

Is there a claim form for the GM OnStar lawsuit?

No. There is no settlement fund, claim form, payout, or deadline in the federal class action at this time. If the MDL settles, a court-supervised claims process with its own eligibility rules would be announced separately, and this page will be updated.

What did the April 2026 court ruling decide?

On April 22, 2026, Judge Thomas W. Thrash, Jr. issued a 200-plus page order largely denying the defendants' motions to dismiss, allowing federal wiretap, Stored Communications Act, unjust enrichment, and many state privacy claims to proceed. A ruling on a motion to dismiss is not a finding of liability — the allegations remain unproven.