GM in $220m multistate driver-data settlement

General Motors (GM) has agreed to a $220 million settlement to resolve claims from a coalition of state attorneys general that it illegally sold drivers’ private data. The agreement, announced on October 29, 2026, addresses allegations that driving behavior and location information collected from GM vehicles was sold to data brokers and then passed on to insurance companies. The action was brought by a coalition of 36 states.

The case centers on GM’s Smart Driver program, which ran from 2016 until it was discontinued in 2024. The program was pitched as a free feature within GM’s connected car apps to help motorists improve their driving safety, tracking behaviors such as driving patterns and seat belt use. State officials said GM promised that data from Smart Driver would not be shared with insurers without customer permission yet allegedly sold personal, identifiable data instead. The complaint stated that insurers used the information to set, and in some instances increase, insurance rates for affected drivers.

Investigators said the OnStar app informed more than 370,000 drivers that they were not enrolled in Smart Driver while their data continued to be collected and sold.

Under the settlement, GM must obtain drivers’ affirmative express consent before it collects or discloses driving and location data. The company is required to limit the data it gathers to what is necessary for the services it provides. The agreement also calls for privacy assessments, including third-party review of GM’s compliance with its privacy program, and mandates privacy-focused training for dealerships. These requirements build on earlier commitments GM made in other regulatory resolutions.

In January 2025, GM entered an agreement with the Federal Trade Commission in which it pledged for five years not to disclose vehicle geolocation and driver behavior data to consumer reporting agencies. In May of that year, GM agreed to a $12.75 million settlement resolving a California investigation into alleged sales of driver data to two data brokers. The latest multistate settlement aligns its consent obligations with those earlier agreements while adding independent oversight of its privacy program.

The $220 million settlement will be distributed among participating states, with Washington state set to receive $12.3 million. The resolution does not provide direct restitution to individual consumers, and a separate private class action related to the data practices remains pending. A separate case in Texas also continues outside the scope of the multistate settlement. These proceedings collectively underscore continued legal scrutiny of how vehicle data is collected and monetized.

GM said the agreement addresses the discontinued Smart Driver product and reinforces actions it has taken to strengthen privacy protections. The company stated that connected vehicle data can enable safer and more personalized experiences and that it is committed to being clear about what information is used, how it is protected, and what choices customers have about sharing it. GM now says it will no longer sell vehicle information that can be linked to an individual, their vehicle location, or how they drive, although it may still share anonymized data not tied to individuals with certain partners.