Montana v. General Motors: a "decline" button that warned of losing services the buyer never had

At the end of a car purchase, a dealer turned the screen toward the buyer and said to "complete the next few steps" before taking ownership. Montana alleges that flow enrolled people in OnStar, and that GM then sold their driving data to brokers who scored them for insurers.

Montana Attorney General · Unfair Trade Practices and Consumer Protection Act · Complaint filed 16 October 2026

Complaint filed 16 October 2026; no answer or ruling yet

Regulator or court: Montana Attorney General (Montana First Judicial District Court, Lewis and Clark County)
Jurisdiction: Montana, US
Framework: Montana Unfair Trade Practices and Consumer Protection Act
Complaint filed: 16 October 2026

Notice, consent scope and assent · Unequal choices or identity checks · Undisclosed data exchanges

The problem

Montana alleges GM and OnStar "deceptively enrolled its customers into a service that collected their driving data and then sold it to data brokers without their consent", and that those brokers sold it to insurers who used it to raise rates (Montana DOJ). The state also alleges that buyers who tried to decline "would be shown misleading warning messages that several of the vehicle’s safety features would be deactivated" (Montana DOJ).

Case record

Court: Montana First Judicial District Court, Lewis and Clark County
Case number: Not published in the sources reviewed
Parties: State of Montana (Attorney General Austin Knudsen) v. General Motors LLC and OnStar LLC
Law: Montana Unfair Trade Practices and Consumer Protection Act
Stage: Complaint filed 16 October 2026 (31 pages, per The Auto Wire); jury trial demanded; GM has not answered
Amount: None; civil fines sought (up to USD 10,000 per willful violation, per The Auto Wire)
Source review: 22 October 2026

What Montana alleged

The court has not ruled. As described in the attorney general’s release and in The Auto Wire’s account of the complaint:

Enrollment looked mandatory. A dealer employee entered the VIN, set up an OnStar account and turned the screen to the buyer, who was told to "complete the next few steps" before taking ownership. The state alleges nobody said the step was optional (The Auto Wire).
Long documents, no sale disclosure. The screen offered a 29-page connected-services terms document, an 18-page privacy statement and AT&T links, with "I accept" and "I decline" checkboxes. The state says none of the documents disclosed the sale of driving data or that it would reach insurers (The Auto Wire; Montana DOJ, "more than 50 pages of disclosures").
A warning about services that were never on. Declining triggered a warning that it "will result in deactivation of all services", including Automatic Crash Response, then a screen saying services "have been deactivated" with a prompt to go back and accept. The state says the buyer had not been enrolled in anything yet (The Auto Wire).
Incentives. GM allegedly paid dealership staff bonuses or commissions for enrollments (Montana DOJ; The Auto Wire).
Where the data went. The complaint describes deals with Verisk (2015), Wejo (2018), LexisNexis Risk Solutions (2019) and Jacobs Engineering (2024), with brokers building "Driving Scores" sold to insurers (The Auto Wire). The data included speed, seatbelt status and hard-braking events (Montana DOJ).

Technical issue

Inth’s technical interpretation: three consent problems stack here. The opt-in was presented as a required step, the refusal path carried a warning that overstated the consequence of saying no, and the disclosures did not name the use that mattered (sale to brokers and insurers). A choice screen is only as good as its worst branch: if "decline" leads to alarming copy and a prompt to go back, the design pushes people toward accepting.

// Refusal path that overstates the consequence and loops back
onDecline(() => showModal({
  text: 'Declining will deactivate all services, including crash response',
  actions: ['Go back and accept', 'Decline anyway'],
}));

// Symmetric choice: same weight, accurate copy, purposes named
renderChoice({
  purposes: ['Safety services', 'Driving data shared with third parties'],
  accept: 'Accept', decline: 'Decline',
  declineNote: 'Emergency calling is unaffected by declining data sharing',
});

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

2015Verisk agreement, per the complaint as reported by The Auto Wire
2018Wejo agreement (same source)
2019LexisNexis Risk Solutions agreement (same source)
3 January 2024Jacobs Engineering agreement (same source)
20 March 2024GM says broker data sharing with LexisNexis and Verisk ended (GM statement of 24 April 2024, quoted by The Auto Wire)
14 January 2026FTC order with GM and OnStar finalised (per The Auto Wire)
16 October 2026Montana files suit in Lewis and Clark County

Outcome

None yet. Montana asks for a permanent injunction, civil fines and an order that GM and OnStar "delete and destroy all driving data including any in the possession of a third party" (Montana DOJ).

What it cost

Montana v. General Motors costs
Item	Amount	Source
Penalties	None yet; civil fines sought	Montana DOJ
Statutory maximum cited	Up to USD 10,000 per willful violation (as reported)	The Auto Wire

Why it matters

Refusal copy is evidence. The state’s case leans on screenshots of what happened after "I decline", not just on the privacy statement.
Offline flows count. The consent moment was a dealership tablet, run by staff paid per enrollment. The same rules apply as for a web banner.
Several states, one practice. California settled with GM over the same data under the CCPA (General Motors); Texas sued in 2024 and the FTC finalised an order in January 2026 (per The Auto Wire).

How Inth catches this

Consent banner: presents accept and decline with equal weight and lets you set the copy for each purpose, so refusal does not need a warning step.
Website audit: records the screens and network requests on each consent branch, including what happens after a refusal.
Evidence: consent records with choice, purposes shown, policy version and time.

Limit: in-vehicle and dealership onboarding systems and server-side data sales are outside what a website audit sees. Review them with the teams that run them.

Checks for your own systems

In the product

Walk the decline path of every consent screen and check that any warning describes a real consequence.
Check whether onboarding copy implies a step is required when it is optional.

In contracts and data flows

List every party that receives usage or telemetry data and check that the notice names that use.
Check revenue-share or licensing deals involving personal data against what users agreed to.

With the people responsible

Ask whether staff or partners are paid per enrollment and how consent is captured in those flows.

Sources and limits

Montana DOJ press release, 16 October 2026
The Auto Wire, "GM Called Your Smart Driver Score a B+...", 20 October 2026 (describes and quotes the complaint)

The complaint itself was not found online and was not reviewed. Screen wording, the broker agreements, dates before 2026 and the per-violation maximum come from The Auto Wire’s account of the complaint. The case number is not published in these sources. GM had not responded publicly as of 19 October 2026 (per The Auto Wire). Montana is not yet a value in the library’s jurisdiction filter, so this draft has no typed jurisdiction.

Source review: 22 October 2026. This page describes allegations and the procedural stage. It does not audit GM’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.