The Car Is Now a Data Lifecycle
GM and OnStar are the subject of this series, and the question is how a connected-car service should treat the information it gathers from California drivers over time. The issue is not only what appears in an enrollment notice. It is whether the original service purpose continues to govern the data as it is used, retained, disclosed, and eventually deleted. By following the GM/OnStar matter through those transitions, readers can build a practical way to judge when vehicle telemetry remains part of a requested service and when it becomes an unexpected third-party asset.
The connected-car record begins with a service relationship
A connected car does not wait for a driver to type information into a form. The vehicle and its connected services can observe events as part of ordinary operation, transmit them to a service provider, and associate them with an account. In the complaint filed by the People of California, GM and OnStar are alleged to have collected names, contact information, driving behavior, and precise geolocation from 2016 onward through OnStar and a feature called Smart Driver. The complaint describes Smart Driver as a way to give subscribers feedback about habits such as hard acceleration and hard braking. It describes location data as supporting functions such as emergency assistance and turn-by-turn directions.
Those details matter because they establish the starting context. A driver who activates a connected-car service can reasonably understand the relationship as one involving safety, assistance, navigation, vehicle information, or feedback about driving. That understanding does not decide every legal question, but it gives later processing a context against which it can be tested. A record collected to help respond to a crash or provide directions is not automatically the same thing as a record collected to evaluate someone for an insurance product.
The California Consumer Privacy Act, or CCPA, uses a broad concept of personal information. It includes identifiers, purchase and commercial information, electronic-network activity, geolocation, audio or visual information, and inferences drawn from those categories. It also defines collection to include buying, receiving, accessing, or observing information, whether actively or passively. A vehicle-generated event can therefore be relevant to privacy law even when the driver never manually submits it. The fact that the information is produced by a machine does not make it neutral or anonymous.
The relationship also has more than two participants. The consumer operates or uses the vehicle. The vehicle or a mobile app produces information. GM and OnStar determine how the connected service is offered and, according to the complaint, how information moves beyond that service. Data brokers and potential downstream users may receive some of the records. Regulators and courts determine which duties apply and what remedies follow. A lifecycle view keeps these relationships visible instead of reducing the issue to a company’s privacy-policy page.
This map is deliberately simple. It does not assert that every connected-car service follows the alleged path, or that every vehicle can perform every control. It shows why the relevant unit of analysis is a chain: collection creates a record, service use gives it an initial purpose, retention keeps it available, disclosure changes who can act on it, and consumer or legal controls may redirect or end the chain.
The same record can cross a boundary
The complaint alleges that GM began selling OnStar and Smart Driver data to LexisNexis Risk Solutions and Verisk Analytics in 2020. The alleged commercial purpose was to develop driver-rating products for insurers. The complaint says GM made approximately $20 million nationwide in connection with those sales. It also describes different data paths. Verisk allegedly received names and addresses with driving-behavior information under a contract that barred precise geolocation. Lexis allegedly received similar behavior information plus GPS data automatically captured during driving events, including the location where the ignition was turned off. In practical terms, the complaint characterizes the latter as the sale of precise parking locations.
The distinction between the two brokers is more important than the generic label “data sharing.” It shows that a decision about a recipient is also a decision about fields. One contract’s restriction does not prove that another recipient had the same restriction. A business that records only “insurer-related partner” has already lost information needed to evaluate necessity, sensitivity, and downstream control. The complaint further alleges that Lexis did not need the precise geolocation for its driver ratings. That allegation, if accepted, illustrates a field-level mismatch: the reason for transferring a driving event did not require transferring every location detail attached to it.
The complaint also alleges that GM’s public statements did not describe this path accurately. It says consumers were told that information would be shared to develop or improve service safety, security, and quality, or when a consumer had elected to receive a third-party service or authorized a request. It further says the CCPA notice denied that GM sold characteristics, behavior, or geolocation data, and that an opt-out mechanism did not affect the data sent to Lexis or Verisk. These are allegations in a government pleading, not findings that were tried and proved in the complaint. They nevertheless identify the kind of break a lifecycle analysis must detect: the language presented at collection, the choice offered to the consumer, and the data path used in practice may diverge.
The legal materials in the source set do different jobs. The CCPA is binding statutory authority. It requires notice at or before collection about categories and purposes, including whether information is sold or shared, and says collection, use, retention, and sharing must be reasonably necessary and proportionate to a disclosed or compatible purpose. The California Privacy Protection Agency’s Enforcement Advisory No. 2024-01 explains how data minimization can be examined through the minimum information needed, possible negative impacts, and safeguards. The advisory is useful guidance, but it expressly does not create a safe harbor or replace the statute and regulations.
The stipulated judgment is different again. It imposes operative requirements on GM, including notice, consent for covered driving-data activities except for listed purposes, deletion and destruction of prior-retained covered data subject to exceptions, and controls for precise-geolocation collection. It also requires a privacy program and assessments. The judgment states that it was entered by stipulation without trial or adjudication of fact or law and without GM admitting liability. It should therefore be read as a binding remedy and compliance framework, not as proof that every allegation in the complaint was adjudicated.
Privacy continues after the notice
The central lesson is that privacy cannot be located at a single moment. Notice matters because it establishes what the consumer is told at collection. Consent and opt-out or limit-use rights matter because they give the consumer a say when the business proposes a covered use or disclosure. Purpose limitation matters because a business cannot treat a disclosed service purpose as a blank check for unrelated processing. Minimization matters because even a legitimate purpose does not justify collecting, keeping, or transferring more information than is reasonably necessary and proportionate.
Retention adds a time dimension. The CCPA requires a business to state how long it intends to retain each category of information, or the criteria used to determine the period, and says information should not be kept longer than reasonably necessary for the disclosed purpose. A record can begin with a valid service function and later become difficult to justify when the function ends. Deletion is not merely an internal database operation, either. The statute generally requires a business receiving a verifiable request to delete information from its records and notify relevant service providers, contractors, and third parties, subject to defined exceptions and limits.
The practical judgment supported by this series is therefore a connected one. When a business proposes to collect or use a vehicle signal, ask what the consumer-facing context is, what exact purpose requires the signal, and what the minimum useful field is. Ask what harm could follow from precision, combination, or disclosure, and which safeguards reduce that harm. Identify the recipient’s role and contractual limits. Set an end point before the data begins to accumulate. Finally, test whether a consumer’s choice, a deletion request, or a material change in purpose reaches every relevant part of the path.
This does not mean that a connected car must stop collecting all information. Emergency response, safe operation, product quality, cybersecurity, diagnostics, warranties, legal obligations, and other bounded purposes can require data. The CCPA and the GM judgment recognize exceptions and conditions rather than demanding indiscriminate erasure. The discipline is to keep those uses tied to their own purpose, field needs, safeguards, and duration, instead of allowing a safety rationale to authorize unrelated commercial reuse.
That is why the GM/OnStar matter is more than a dispute about a privacy statement. It puts a recognizable service relationship beside a disputed downstream use and asks whether the connection between them was preserved. The remaining chapters examine the points where that connection can fail: what consumers were told and asked to choose, how a service record can become a new product, why precise geolocation raises the stakes, how retention and deletion travel, and what contracts and assessments must do to make the duty operational.