GM warns of unlimited litigation threat for selling private customer data
Automaker fights OnStar-related lawsuits while announcing stock buybacks
General Motors disclosed on Tuesday that the automaker is facing significant liability over allegations that it secretly gathered and sold private personal information from millions of customers, according to new filings with the Securities and Exchange Commission (SEC).
The company’s annual report for the year ending Dec. 31, 2025 notes that GM has already accumulated $500 million in costs related to investigations and litigation involving use of its OnStar Smart Driver technology — and warns it can’t even estimate the potential financial impact.
GM is the target of state attorneys general and private law firms that have filed lawsuits against GM alleging misuse of its OnStar technology.
Arkansas Attorney General Tim Griffin is seeking $10,000 per offense for more than 100,000 residents impacted — or $1 billion in that southern state alone.
Texas Attorney General Ken Paxton is seeking up to $10,000 per violation plus up to $250,000 more for each victim aged 65 or older in a state with more than 1.8 million victims of the GM scheme. That means Paxton is seeking at least $18 billion, not including the added penalty for senior citizens, according to his 36-page court filing. Note: He won a $1.4 billion settlement with Meta (Facebook) in 2024 involving use of personal biometric data.
GM collected driver data including average speed, frequency and intensity of acceleration, braking and sharp turns, percentage of time that the speed exceeded 80 mph, late-night driving habits and geolocation as frequently as every 3 seconds, according to federal regulatory documents and lawsuits reviewed by Shifting Gears.
That driver information was sold to data brokers, who sold it to insurers, who used it to hike car insurance rates on customers driving Chevrolet, GMC, Cadillac and Buick vehicles, according to legal claims from state attorneys general and private lawyers.
“In response to a congressional inquiry, GM was vague and evasive with respect to its data harvesting and selling, but ultimately it admitted it was tracking its drivers and selling this information to Verisk Analytics, and LexisNexis Risk Solutions Inc.,” said Cotchett, Pitre and McCarthy law on its website. The firm, based in Burlingame, California, has filed one of the lawsuits. “Faced with consumer and congressional outrage over its profiteering from the collection of driver data, in March 2024, GM stopped the practice. But it has done nothing to compensate drivers subjected to these wrongful practices.”
These issues were raised first in a report by the Mozilla Foundation, a non-profit that advocates for accessible user-controlled technology, in August 2023. The New York Times wrote about the secret revenue stream on March 11, 2024. GM announced its decision to quit sharing driver behavior with data brokers on March 22, 2024.
New York Times tech columnist Kashmir Hill, a Chevrolet Bolt owner, wrote on April 23, 2024 about her family being data mined.
One report “recounted 297 trips, had a high-level summary at the top: 1,890.89 miles driven; 4,251 driving minutes; 170 hard-brake events; 24 rapid accelerations, and, on a positive note, zero speeding events,” Hill said. “… the data from our Bolt accrued to my husband alone because the G.M. dealership listed him as the primary owner.”
GM is being sued by attorneys general Mike Hilgers of Nebraska and Todd Rokita of Indiana, too. The legal fights are just beginning with alleged victims all over the country.
The landscape from a GM viewpoint
This week, GM CEO Mary Barra reported to shareholders during the earnings call that 2025 saw a decline in revenue, net income, and adjusted earnings before interest and taxes from a year earlier.
She also announced stock buybacks and increased dividend payments to the delight of shareholders, which inched the stock price up 9% by the end of the day.
Barra told Bloomberg during a podcast interview that“2025 was an exceptional year” marked by “agility” and “resilience.” She forecasted growth in market share with big trucks and big SUVs in 2026, aided by “regulatory change” and a shift in national policy that no longer prioritizes efforts to reduce air-polluting emissions. As part of its strategy realignment, GM laid off more than 1,000 workers in Detroit.
Barra focused on growth of the company’s in-vehicle software and subscription business, which generated $2 billion and $5 billion respectively during the last nine months of 2025. The company said it now has 11 million subscribers for its OnStar safety system, up 34% from a year earlier, Business Insider reported in its story headlined: “GM is quietly becoming a subscriptions company.”
Back in October 2021, GM posted on its investor website that Barra was leading a pivot to a “software-defined vehicle” strategy, aiming to generate significant revenue through subscription data services, with a goal of $20 billion to $25 billion in annual software-enabled services by 2030.
OnStar, a subsidiary of GM that provides subscription-based communication and remote diagnostics systems, is named in the consumer fraud litigation, too.
Shareholders have been warned
Anyone reviewing financial documents for risk assessment can’t help but notice GM warnings toward the end of its Form 10-K document filed with federal regulators.
Automakers often list litigation and other concerns to shareholders, who expect some level of transparency about potential loss. (In 2024, GM paid $146 million in penalties for selling 2012-2018 model year vehicles that failed to comply with GM claims, according to the U.S. Environmental Protection Agency.)
Yet the GM filing with the SEC on Tuesday characterized the situation so potentially significant that, “At this stage, we are not able to estimate any reasonably possible or probable material loss or range of loss that may result from these actions …”
GM wrote in its earnings document: “There are putative class actions pending against GM in federal courts in the U.S. alleging violations of state and federal privacy and consumer protection laws related to the collection and use of certain consumer data obtained through our former OnStar Smart Driver product. In June 2024, those class actions were consolidated into a multi-district litigation proceeding in the Northern District of Georgia.”
GM continued, “In addition, several states have filed enforcement lawsuits against us, and other state attorneys general have opened investigations or made inquiries of us relating to these alleged consumer protection and privacy issues. The Company resolved a Federal Trade Commission investigation through an agreed administrative consent order. The Company is defending litigation filed against us and fully cooperating with agencies and attorneys general that are conducting investigations.”
For context, the initial sum initially spent on the OnStar litigation scandal — listed as $0.5 billion in the earnings document filed Jan. 27 — might be compared to the total profit sharing sum GM will pay to its 47,000 UAW members at $10,500 each on average. (Profit sharing is not a bonus but a percentage of profits negotiated by the labor union, or $1,000 for every $1 billion in pretax profits in North America, a strategy meant to share success in good times and pain in bad times.)
FTC: ‘Unchecked surveillance’
The Federal Trade Commission pursued action against GM for using “a misleading enrollment process” to get consumers to sign up for its OnStar connected vehicle service and the OnStar Smart Driver feature while GM failed to disclose its plan to sell the information to parties including consumer reporting agencies.
The FTC finalized earlier this month an order that bans GM from disclosing driver data to consumer reporting agencies for five years.
“With this action, the FTC is safeguarding Americans’ privacy and protecting people from unchecked surveillance,” Lina M. Khan, immediate past chair of the FTC and a Columbia University law professor, said in a news release.
Texas: GM deceit led to higher insurance rates
Barra didn’t discuss during her earnings remarks how much time or money GM has spent dealing with this legal mess, or how many hundreds of millions or billions of dollars could be at stake.
Texas Attorney General Paxton claimed that GM misled consumers by hiding its data sharing plan within complicated terms of service agreements that left consumers with the idea that the OnStar program was for safety rather than a revenue scheme for the company.
He tried to broaden the lawsuit to include past offenses — and show a pattern of deceit — but GM argued successfully that its prior bankruptcy status (in 2009) freed the current company from any liability from actions committed as the now-defunct General Motors Corp., or “Old GM.”
The U.S. Bankruptcy Court for the Southern District of New York ruled in October 2025 that the Texas lawsuit must remain focused on the alleged decade of data collection without elements that suggest a deeper, ongoing pattern of deception —including ignition switch issues and fuel tank fires.
GM collected data from more than 14 million vehicles, including more than 1.8 million Texans, without consent, according to Paxton’s lawsuit filed Aug. 13, 2024. Data included date of travel, start time, end time, GPS coordinates, amount of fuel used, distance driven and seatbelt status of driver and passenger, he said.
“Unbeknownst to these customers, insurers could and did use these scores and data to make significant decisions that impacted customers, including monthly premium increases, dropped coverage or coverage denials … GM profited handsomely from these agreements” — unlocking “millions in lump sum payments,” the lawsuit said.
Some of the information sold was personally identifiable, including name, home address, phone number and email, GM customers have alleged.
“American drivers wanted to buy a car, not a comprehensive surveillance system that unlawfully records information about every drive they take and sells their data to any company willing to pay for it,” Paxton said after filing the lawsuit.
GM incentivized car dealers with commissions to get people signed up, discouraging customers from declining to enroll by suggesting that declining would result in de-activation of vehicle safety features, the lawsuit claimed.
Texas said it wants the court to penalize GM for false and deceptive conduct.
GM customers in Michigan
Karen and Melvin Drews of Concord, Michigan, owned a 2019 Chevrolet Corvette and a 2020 Buick Enclave and said they had no knowledge of agreeing to share their personal data. So they were shocked to get notified by their insurance company around Jan. 2, 2024 that their insurance rates were going from approximately $1,940.87 to $3,741.03 per year.
This is how Karen and Melvin Drews became plaintiffs in a lawsuit against GM.
“They asked their insurer why their rates were increasing, and they were told that it was because of a credit pull … which exceeded 200 pages, over 150 pages of which was detailed information about car trips that Plaintiffs took in both vehicles in the prior six months, including information about the date and time of each trip, the distance and location, and driving details such as rapid acceleration and hard braking,” according to a lawsuit filed May 3, 2024 in the U.S. District Court for the Eastern District of Michigan, by The Miller Law Firm of Rochester, Michigan; Cotchett, Pitre and McCarthy; and Blood Hurst and O’Reardon of San Diego, California.
In early December 2025, a judge in Lancaster County, Nebraska, denied GM’s motion to dismiss the lawsuit brought by the state attorney general, saying, “State has alleged sufficient facts to state a claim to relief that is plausible on its face."
No one seemed to have any idea this was happening until Hill wrote her story, “How G.M. tricked millions of drivers into being spied on (including me)” for the The New York Times in April 2024.
More:
Can Mary Barra helm GM while juggling board gig at embattled Disney?
$1M carmaker gifts for Trump, not Biden
Sherry House, GM engineer turned investment banker, named Ford CFO
I’m honored to be part of The Iowa Writers’ Collaborative — sort of a Heartland version of the New York Times, featuring political analysis, features and news. Check it out.
Geeeeeezus G M! How lousy of you. Probably, if you had given the option to the consumers to either have that checking system attached or not may have gotten decent results. But when they’re gonna use that secretly obtained data against you with the insurance companies, there’s no question they did a bad thing.
Great research. Thanks again for your work.
PEACE
My MAGA congressman claims Roomba vacuum cleaners are gathering valuable personal information, while they sweep home hallways and living room carpets, then sending it to the Chinese Communist Party, endangering national security. Presumably, all the information thieves are storing their ill gotten booty in massive data farms, which now encircle the metropolitan area around Des Moines, Iowa. As a resident, I’ve always wondered why these massive facilities were allowed to be built over the world’s finest agricultural soil. Also, draining huge amounts of water from already distressed aquifers. The reason? There must be some very important uses for all this personal information because conglomerates are willing to pay top dollar for it! What a crazy world this has become.