General Motors has agreed to pay $220 million to settle claims by 36 state attorneys general that it illegally sold private driving behaviour and location data collected through its Smart Driver programme. The GM Smart Driver settlement, announced on Thursday, October 29, 2026, is one of the largest state-led privacy settlements involving a carmaker, and it resolves allegations that millions of drivers joined a programme pitched as a way to improve their driving, only for their data to be passed to data brokers who resold it to insurers that used it in part to set premiums.

The coalition covers 35 states plus Washington, D.C., and was co-led by Washington Attorney General Nick Brown and Oregon Attorney General Dan Rayfield. State shares disclosed so far include $12.3 million for Washington, more than $10.4 million for Oregon, $8.67 million for Pennsylvania, $4.7 million for Delaware and $3.1 million for Idaho.

Key Points

• General Motors will pay $220 million to 36 states, including Washington, D.C., over its Smart Driver data programme.
• Regulators say data from nearly 10.3 million drivers was sold to data brokers and resold to insurers between 2016 and 2024.
• The data included hard braking, rapid acceleration, speeding, seat-belt use, late-night driving and trip times.
• More than 370,000 drivers were wrongly told by the OnStar app that they were not enrolled while GM collected and sold their data.
• GM must now obtain affirmative express consent before collecting or sharing driving and location data, and it will no longer sell data tied to an individual, their location or how they drive.

What Happened

The multi-state investigation found that, between 2016 and 2024, GM enrolled millions of drivers in Smart Driver and told them it would not share their data with insurers without their express consent. According to the states, GM nevertheless sold the data under contracts specifying insurance use, allowing brokers to resell it to insurers. Those insurers then used the information in part when setting premiums, so everyday habits recorded by a connected car could quietly influence what a driver paid for cover.

The settlement ends the states’ claims without GM admitting liability. GM ended Smart Driver in 2024, before the settlement was reached. Alongside the payment, it accepted forward-looking obligations: affirmative express consent before collecting or sharing driving and location data, limits on what it collects, a comprehensive privacy programme with third-party compliance assessments, and dealership oversight.

Background: The GM Smart Driver Settlement Explained

Smart Driver was presented as a tool for improvement. Drivers who signed up were told, in substance, that it would help them understand and improve their driving. Behind that pitch, the states say, was a commercial pipeline in which driving behaviour and location data were sold onward. The data was detailed: trip start and end times, hard braking, rapid acceleration, speeding, seat-belt use and late-night driving.

The case also highlights a second failure regulators regarded as especially serious. More than 370,000 drivers — 380,000 according to Idaho’s figures — were wrongly told by the OnStar app that they were not enrolled, even as GM continued to collect and sell their data. Some drivers who believed they had opted out, or had never knowingly opted in, were in the programme anyway. That goes to the heart of the complaint: consent, to be meaningful, must match what actually happens to a person’s data.

Reactions

The attorneys general who led the case presented the settlement as a correction to a business model that treated drivers’ private journeys as a saleable commodity. Their position is that drivers were promised their data would not be shared with insurers without express consent, while the company’s commercial arrangements did the opposite. The state shares, led by Washington and Oregon, reflect the size of the affected driver population in each state.

GM did not admit liability, a standard feature of such agreements. It has ended Smart Driver and accepted the new consent, collection and oversight requirements, which will be monitored through third-party assessments. Privacy advocates are likely to watch those assessments closely, since the practical question is not only what GM promises now, but whether its systems, dealership practices and data contracts actually enforce those promises.

Why It Matters

The case matters well beyond General Motors because it sets a practical benchmark for the connected-car industry. If a carmaker must obtain affirmative express consent, limit collection to what is genuinely needed and accept independent compliance checks, rivals with similar programmes will face pressure to meet the same standard. Dealerships are now part of the oversight picture too, which matters because enrolment in connected services often happens at the point of sale, when a buyer is focused on financing and delivery rather than data terms.

It also matters for insurance. The allegation that driving data was resold to insurers and used in part to set premiums touches a sensitive question: should a premium reflect behaviour recorded by a car, and if so, only with the driver’s clear, informed agreement? Usage-based insurance is not unlawful in itself, and many drivers willingly share data for a discount. The GM case draws a line between that voluntary bargain and a system in which data is collected under one promise and sold under another.

What Happens Next

GM must now implement the settlement’s requirements, including the consent rule, collection limits, a comprehensive privacy programme, third-party assessments and dealership oversight. How quickly and transparently those changes are rolled out will be watched by regulators and by drivers who want to know exactly what their vehicles record and share.

The pending private class action is the next chapter for individuals. Its outcome will determine whether affected motorists receive direct compensation, and it may produce further disclosures about how the data was priced, packaged and used by insurers. Other carmakers can expect closer scrutiny of their enrolment screens, privacy notices and data-sharing contracts, particularly where an app tells a driver one thing and a back-end system does another.

Frequently Asked Questions

How much is GM paying in the Smart Driver settlement?

General Motors agreed to pay $220 million to a coalition of 36 state attorneys general, covering 35 states plus Washington, D.C.

How many drivers were affected?

The states say data covering nearly 10.3 million drivers was sold to data brokers who resold it to insurers between 2016 and 2024.

What data was collected and sold?

Trip start and end times, hard braking, rapid acceleration, speeding, seat-belt use and late-night driving, along with location data.

Will individual drivers receive money from the settlement?

No. The $220 million goes to the states, not to individual drivers. A private class action is still pending and is the route through which drivers might seek personal compensation.

What must GM do now?

GM must obtain affirmative express consent before collecting or sharing driving and location data, limit what it collects, run a comprehensive privacy programme with third-party compliance assessments, submit to dealership oversight, and no longer sell data tied to an individual, their location or how they drive.

Related coverage: Meta and Snap face a youth-harm trial over data and design and Meta’s $95 billion AI raise leads a $198 billion day of AI spending.