On 29 October 2026, General Motors agreed to pay $220 million to settle allegations that it illegally collected and sold data about how its customers drove.
The coalition behind the settlement comprised 36 attorneys general, representing 35 states and the District of Columbia, led by Washington and Oregon. Reporting describes it variously as 36 states or 35 states plus DC, which is the same group counted two ways.
The case concerns OnStar Smart Driver, a feature inside GM's connected car apps that tracked and rated driving behaviour, including braking, acceleration, speeding and seat belt use. It ran from 2016 until GM discontinued it in April 2024, after a New York Times investigation.
North Carolina's attorney general summarised the allegation bluntly: "General Motors told drivers it would keep their data private."
One thing to be clear about before anything else: the $220 million does not go to drivers. It is divided among the participating states. Individual drivers whose data was sold receive nothing from this settlement.
What happened
The programme
Smart Driver was marketed as a way for drivers to improve their habits. It was bundled into OnStar, GM's connected services platform.
The enrolment mechanism is the part that matters. Most enrolments happened at franchised dealerships during the vehicle purchase, when Smart Driver was included in the registration process for OnStar. A customer buying a car signed up for connected services and, in doing so, was enrolled in behavioural tracking.
According to the states, GM then sold identifiable data from Smart Driver accounts to data brokers, principally LexisNexis and Verisk, which compiled it into reports sold to auto insurers. Insurers use this kind of telematics to price policies, meaning a driver's premium could be affected by data they did not know was being collected.
Washington's attorney general, Nick Brown, described what was sold: "The data GM sold was personal, identifiable, and specific."
The scale
10.3 million drivers had their OnStar driving data sold, according to the coalition.
More than 370,000 drivers were told by GM's OnStar app that they were not enrolled in Smart Driver, while the company was in fact collecting and selling their data.
GM allegedly earned more than $20 million from the programme, according to a related proposed class action.
That last figure deserves a pause. The alleged revenue was around $20 million. The settlement is $220 million, roughly eleven times what the programme made.
The 370,000
This is the single most damaging detail in the case, and it is worth separating from the rest.
A suspicious driver, who went into the app and actively checked whether they were enrolled in behavioural tracking, was told no. And the collection continued.
Whether that was a deliberate deception or a software defect is not established in the settlement. GM did not admit wrongdoing. But from the driver's position the distinction is academic: they did the responsible thing, got a reassuring answer, and were wrong.
What GM must now do
Beyond the payment, the settlement requires GM to:
Obtain affirmative express consent from consumers before collecting or disclosing driving and location data
Limit the driving data it collects
Operate a comprehensive data privacy programme
Undergo internal and external data protection and privacy assessments
What it does not do
Data already sold stays sold. Records that went to data brokers and insurers before the programme ended remain with them. The settlement governs GM's future conduct, not the copies held by third parties.
Drivers are not compensated. The money goes to state treasuries. Reported shares include $12.3 million to Washington, $7.66 million to North Carolina and $5.7 million to Massachusetts.
This is the third action, not the first
GM has now been through three separate processes over the same programme:
When | Action |
|---|---|
January 2026 | FTC finalises a 20-year consent order banning GM and OnStar from sharing precise location and driving data with consumer reporting agencies for five years |
May 2026 | Separate settlement with California for $12.75 million |
October 2026 | This $220 million multistate settlement |
GM's position is consistent across all three. A spokesperson said the agreement addresses a product the company ended in 2024 and reinforces steps already taken on privacy practices.
Why it matters
Consent bundled into a purchase is not consent. The mechanism here was ordinary and is still widespread: a feature enabled during registration at the point of sale, inside a longer process, while the customer is focused on buying a car. The settlement's central remedy, requiring affirmative express consent, is a direct attack on that pattern.
Cars are data platforms now. Modern vehicles carry sensors, cameras, GPS and persistent connectivity. Smart Driver tracked braking and speeding, which sounds narrow until you consider that it was combined with precise location. The settlement arrives as more sensor-laden vehicles enter the market, and the economics that made this attractive have not changed.
The penalty is calibrated to deter, not to compensate. Eleven times the programme's revenue is a deliberate signal. If the fine had been $20 million, it would have been a licence fee. Other manufacturers running similar telematics arrangements should read the ratio rather than the absolute number.
Enforcement is stacking. Federal regulator, one large state acting alone, then a 36-strong coalition. Each action addressed the same conduct from a different angle, and the total exceeds $250 million.
The accountability gap is real. Ten million drivers had data sold. None of them receive anything. The money improves state budgets and the mandated changes improve future practice, but the people whose insurance premiums may have been affected have no remedy here.
Who is affected
Roughly 10.3 million GM drivers whose OnStar driving data was sold, who receive no payment from this settlement.
The 370,000-plus who were told they were not enrolled while their data was being collected.
Anyone whose insurance premium was priced using this data, which is difficult to establish retrospectively.
Other vehicle manufacturers running telematics programmes, who now have a clear precedent for what regulators consider unlawful.
Data brokers and insurers in the automotive telematics supply chain, including the named recipients.
Consumers generally, through the consent standard this sets for connected vehicles.
What to do
If you drive a connected car
Check what telematics programmes your vehicle is enrolled in, through the manufacturer's app and account settings, not just the car's infotainment screen.
Do not assume an app's answer is correct. This case established that 370,000 people were told they were not enrolled when they were. Where you can, verify through customer support and ask for confirmation in writing.
Review what you agreed to at the dealership. Connected services registration is where many of these enrolments happen, and most buyers do not read it.
Ask your insurer whether telematics data informs your premium, and from which source.
Request your data where you have the right to. In the EU and UK, GDPR gives you a right of access that covers telematics records held about you.
If you operate a product that collects behavioural data
Separate consent for data collection from the purchase or registration flow. Bundling is the practice this settlement targets.
Make the enrolment status accurate and checkable. The most expensive single fact in this case was an app that displayed the wrong answer.
Document what you share and with whom. The chain from manufacturer to broker to insurer is what turned a tracking feature into a regulatory matter.
Assume that discontinuing a programme does not end liability. GM shut Smart Driver down in 2024 and faced three enforcement actions afterwards.
Weigh the revenue against the exposure. A programme earning $20 million produced over $250 million in settlements across three actions.
Final thoughts
A feature presented as helping people drive better was, on the states' account, a data collection programme feeding the insurance industry. Drivers were enrolled while buying a car, the data was sold on, and when some of them checked whether this was happening, the app told them it was not.
The lesson for anyone building products that collect behavioural data: the consent mechanism is the whole case. GM never defended itself by saying the data wasn't collected or sold. The dispute was about whether drivers knowingly agreed, and that question was settled by how enrolment worked at the dealership and what the app displayed afterwards. Everything else followed from those two design decisions.
The second lesson is about proportion. The programme allegedly made just over $20 million. GM has now paid $12.75 million to California, faces a 20-year FTC consent order, and will pay $220 million to 36 attorneys general. Regulators are pricing this conduct deliberately above what it earns, which is the only pricing that changes behaviour.
Worth sitting with, finally: ten million people had data about their driving sold to insurers, and not one of them gets anything from this. The remedy is prospective. For the drivers themselves, the settlement changes what happens next, not what already happened.
