GM pays $220m to 36 states over selling drivers' data to insurers

GM pays $220m to 36 states over selling drivers' data to insurers

29 October 2026: General Motors will pay $220 million to settle claims by 36 state attorneys general that it sold drivers' behaviour and location data to data brokers, who sold it on to insurers that used it to set premiums. Beyond the money, the settlement requires GM to obtain affirmative express consent before collecting or disclosing driving and location data, to limit what it collects, and to put dealership staff through training so customers are not enrolled without knowing. Washington, which co-led the case with Oregon, receives $12.3 million.

Smart Driver and the dealership sign-up

From 2016 to 2024, GM enrolled millions of drivers in Smart Driver, a feature it presented as a way for drivers to improve their own safety, while telling them their data would not go to insurers without express consent. According to the Washington attorney general, GM sold the data to brokers under contracts that specified it was for insurance products. The data was detailed: how often a person drove, when each trip started and ended, how often they braked or accelerated hard, and whether they exceeded the speed limit.

Most drivers were signed up at the dealership when they bought the car, through a single process that also enrolled them in OnStar. The attorney general says dealership staff in many cases accepted the terms on customers' behalf, at a time when GM paid sales bonuses partly on connected-service sign-ups and ranked dealers by enrolment. GM's OnStar app told more than 370,000 drivers they were not enrolled when they were; GM later unenrolled them without saying so and left their data with the brokers and insurers. GM ended Smart Driver after the practice was reported.

What the settlement requires

• affirmative express consent before collecting or disclosing driving and location data;
• limits on the driving data GM collects, within a comprehensive privacy programme;
• internal and external assessments of that programme;
• oversight and training at dealerships against enrolling customers without consent.

Washington's attorney general describes the terms as stronger than any other resolution reached with GM over the same conduct.

For connected-car data in general

The case sets out, in an enforcement settlement, what the states expect of a carmaker's data practices: consent obtained from the driver, not ticked by a salesperson; an app that tells drivers the truth about their enrolment; and no sale for insurance pricing without that consent. Fleet operators, insurers and telematics firms buying driving data from manufacturers or brokers are the other side of the same trade, and the provenance of that consent is now the thing to ask about.

The coalition was co-led by Washington and Oregon, with an executive committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont. We list General Motors as a car manufacturer.

Related on TrustList:

• Mobileye will supply cloud-mapped driver assist to Stellantis from 2027
• China drafts mandatory car data security and automated parking standards
• vsomeip flaw lets one 16-byte message crash car middleware

Sources

• Washington State Attorney General: GM to pay $220M for sharing drivers' private data in case co-led by Washington, 29 October 2026