GM to Pay $220m to Settle States' Driver Data Case

General Motors will pay $220m to settle claims by 36 US state attorneys general that it sold drivers’ behaviour and location data from its Smart Driver programme to data brokers, who then sold it on to insurers. The settlement was announced on 29 October by Washington Attorney General Nick Brown and, separately, by Oregon Attorney General Dan Rayfield. The two states co-led the case.

The core term is consent. GM must obtain drivers’ “affirmative express consent” before it collects or shares their driving and location data, according to both releases. Washington will receive $12.3m and Oregon more than $10.4m.

Under the Washington consent decree, filed in King County Superior Court, GM agreed to the terms “without admission of any facts or liability as alleged in the Complaint”. The allegations below are the states’ account and have not been tested at trial.

What the states allege

According to the attorneys general, GM enrolled millions of drivers in Smart Driver between 2016 and 2024. The states say GM promoted it as a way for drivers to improve their own safety and told them it would not share their data with insurers without express consent.

The states say GM instead sold the data to brokers under contracts that specified it was to be used for insurance products. The brokers then sold it to insurers, which in some cases used it in part to set premiums. Both releases say GM did not tell drivers their data would be used this way.

The data was detailed, the states say. Insurers could see how many times a person drove, when each trip began and ended, how often they braked or accelerated hard, and whether they exceeded the speed limit.

Most drivers were signed up at the dealership when they bought a car. According to the states, one sign-up process covered both Smart Driver and GM’s OnStar services, and in many cases dealership staff allegedly accepted the terms on customers’ behalf. The states say sales staff earned bonuses linked partly to connected-service enrolments, and dealerships were ranked on their numbers.

The states also say the OnStar app wrongly told more than 370,000 drivers that they were not enrolled in Smart Driver when they were. GM later unenrolled those drivers without telling them about the error, the states allege, and left their data with the brokers and insurers. GM ended Smart Driver in 2024 after The New York Times reported on the practice.

“People bought a car, not a tracking device,” Rayfield said. Brown said: “Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used.”

What GM has agreed to

Beyond the consent requirement, the states say GM must limit the driving data it collects, run a comprehensive privacy programme, submit to internal and external assessments of that programme, and train and oversee its dealerships so customers are not enrolled without consent.

The decree sets out the detail. GM must pay the $220m within 30 days of the effective date. It must employ a chief privacy officer to oversee the programme. An independent assessor must be hired within 90 days, with a first assessment covering the first year and further assessments every two years for four years after that. The privacy programme runs until 13 January 2046, although some provisions expire after ten years.

In a statement reported by The Record, a GM spokesperson said the “agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.”

Why dealership consent is the part to watch

This is the second regulatory settlement over the same conduct. In January 2026 the Federal Trade Commission finalised its own order with GM and OnStar. That order bans GM for five years from sharing geolocation and driver behaviour data with consumer reporting agencies and requires express consent for 20 years. The FTC’s release describes conduct rules and does not list a payment. The states now add $220m and say their terms are “significantly stronger than any other resolution reached with GM for this conduct”.

The most practical change may be at the dealership. The states’ case rests on the claim that consent was collected at the point of sale, sometimes by staff on commission rather than by drivers themselves. A consent rule on paper does little if the person ticking the box is a salesperson with an enrolment target. That is why the dealership oversight and training terms, and the outside assessments, matter more than the headline figure for anyone judging whether the deal works.

The case also shows how states are using older laws for newer data problems. Oregon says it sued under its Unlawful Trade Practices Act because much of the conduct predates its consumer privacy law, which took effect in July 2024. That approach echoes other recent state actions against tech firms, such as Texas’s suit against OpenAI, which also rests on consumer protection law.

Pricing based on personal data is drawing scrutiny elsewhere too. The FTC has just ordered nine firms to explain personalised pricing, and in Europe the privacy group noyb has accused Scale AI’s Outlier of tracking its workers.

Not every state signed up. The Record reports that a separate suit filed by Texas Attorney General Ken Paxton in 2024 is still ongoing; Texas is not in the coalition list.