Loading story…
The U.S. Federal Trade Commission (FTC) finalized a 20-year consent order with General Motors (GM) and its subsidiary OnStar after alleging the companies collected and sold precise geolocation and driving behavior data from millions of drivers without valid consent. The FTC said GM’s now-discontinued Smart Driver feature was presented as a driving-habits tool while enabling extensive telematics collection (including location and behavior signals such as braking and speed), with data flowing to third parties and ultimately being used by insurers in ways that could affect premiums or coverage decisions.
Under the order, GM is banned for five years from sharing consumers’ geolocation and driving behavior data with consumer reporting agencies. For the full term of the order, GM must obtain express consent before collecting, using, or sharing connected-vehicle data (with limited exceptions such as emergency services), and must provide consumer controls including the ability to opt out/disable precise geolocation collection, request copies of their data, and seek deletion. Reporting also notes GM shut down Smart Driver in 2024 amid backlash and said it ended related third-party telematics arrangements tied to data brokers such as LexisNexis and Verisk.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
After the order was finalized, GM said it had expanded its privacy program to give consumers more transparency and control, including mechanisms to access and delete data, disable precise geolocation collection, and opt out of certain data collection.
On January 14, 2026, the FTC finalized a consent order with GM and OnStar barring them from sharing precise location and driving-behavior data with consumer reporting agencies for five years. The broader 20-year order also requires express consumer consent for connected-vehicle data collection, use, or sharing, with limited exceptions.
The FTC filed a complaint in January 2025 alleging that GM and OnStar collected precise geolocation and driving-behavior data from millions of drivers without clear consent and sold it to third parties, including consumer reporting agencies used by insurers.
In January 2025, Texas Attorney General Ken Paxton sued Allstate over allegations that driving data was collected without consent through an Arity SDK embedded in popular apps and shared in connection with multiple automakers.
General Motors said it discontinued its OnStar Smart Driver feature in April 2024 following customer backlash, unenrolled users, and ended third-party telematics arrangements that fed driver data to LexisNexis and Verisk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
General Motors agreed to pay **$12.75 million** to settle California allegations that it collected, retained, and sold drivers’ geolocation, driving behavior, and other personal data without proper knowledge or consent, in violation of the **California Consumer Privacy Act (CCPA)**. Prosecutors said GM used data gathered through its **OnStar** service and sold it to **LexisNexis Risk Solutions** and **Verisk Analytics**, which sought to use the information in driver-rating products for insurers; California said GM made about **$20 million nationwide** from the sales. Under the proposed settlement, GM must stop selling driving data to consumer reporting agencies for **five years**, delete retained driving data within **180 days** unless consumers provide affirmative express consent for limited internal uses, and ask LexisNexis and Verisk to delete data they previously received. The agreement, which still requires court approval, also requires GM to establish and maintain a privacy program tied to OnStar data collection and provide privacy assessments to California authorities; officials described the penalty as the **largest CCPA fine to date**.
Jun 29, 2026
The U.S. Federal Trade Commission reached a proposed settlement with data broker **Kochava** and its subsidiary **Collective Data Solutions** that would prohibit them from selling, sharing, or disclosing sensitive location data without consumers’ **affirmative express consent**. The FTC said Kochava sold precise geolocation data tied to hundreds of millions of mobile devices, along with related information such as mobile device IDs, app usage data, and demographic details, in ways that could expose visits to sensitive locations including **health care facilities** and **places of worship**. The proposed order, approved by the FTC in a 2-0 vote and filed in federal court in Idaho, requires Kochava to limit sensitive location data use to consumer-requested services, verify suppliers’ consent practices, notify the FTC about certain improper third-party disclosures, tell consumers who purchased their precise location data, allow consent to be withdrawn, and follow a retention and deletion schedule. The case stems from an FTC lawsuit first filed in 2022, and while the settlement does not impose a fine, it formalizes restrictions that overlap with commitments Kochava had already made in a separate class-action settlement to stop monetizing sensitive location data collected through app SDKs.
Jul 2, 2026
The US Federal Trade Commission reached settlements with Cox Media Group Local Solutions and marketing firms **MindSift LLC** and **1010 Digital Works LLC** over claims that an ad product marketed as **"Active Listening"** or **"Voice Data"** could use AI and microphone data from phones, smart TVs, and other smart devices to target ads based on consumers’ conversations. The companies promoted the service in 2023 and 2024 as if consumers had opted into voice-data collection and as if advertisers could use captured speech to improve localized ad placement, raising concerns that devices were secretly listening to users. The FTC said those claims were false: the service did **not** listen to conversations, did **not** collect voice data, and did **not** deliver the advertised location-based targeting. Instead, Cox Media Group allegedly resold email lists obtained from other data brokers at a markup. Under the settlements, Cox Media Group will pay **$880,000**, while MindSift and 1010 Digital Works will each pay **$25,000**, for a total of **$930,000**; the money is intended to refund affected customers misled by the marketing.
Jun 29, 2026