General Motors has agreed to pay $220 million to settle claims from a bipartisan coalition of 36 attorneys general. The states say the automaker enrolled millions of drivers in its Smart Driver program and then sold their driving and location data to data brokers, under contracts that specified the data was to be used for insurance products. Washington, which co-led the case with Oregon, says its share is $12.3 million.
The money will get the headlines, but the conduct rules matter more. Under the settlement, GM has to get affirmative express consent before it collects or discloses driving and location data. In plain terms, a driver has to actively agree. A default setting or a box ticked on their behalf doesn't count. GM also has to limit how much data it collects, run internal and external privacy assessments, and train and oversee its dealerships, where the states say much of the enrollment happened.
What GM did, according to the states
The Washington Attorney General's office says GM enrolled millions of drivers in Smart Driver between 2016 and 2024. The Register reports that the data covered precise location, speed and seatbelt use. GM sold that data to brokers, the brokers supplied insurers, and the contracts with those brokers specified insurance as the use.
The states say the consent problems started on the showroom floor. Sales staff received bonuses based partly on how many customers signed up for GM's connected services, and the states allege that in many cases dealership employees accepted the terms on the customer's behalf. That detail matters for anyone who runs a consent flow: if a third party can click "agree" for the user, you don't have consent.
The most striking allegation involves GM's own OnStar app. According to the Washington AG, the app told more than 370,000 drivers that they were not enrolled in Smart Driver while their data kept flowing. GM later quietly unenrolled those drivers and didn't tell them. So the one screen a careful customer might check to see their privacy status was wrong.
The Register reports that GM ended Smart Driver in April 2024, just over a month after a New York Times investigation exposed its data-sharing practices.
Who brought the case
The Register counts the coalition as 35 states plus the District of Columbia, which matches the Washington AG's figure of 36 attorneys general. Washington and Oregon led it, with an executive committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont. The Washington AG calls the agreement bipartisan, which suggests that selling connected-car data without real consent is no longer a partisan issue for state enforcers.
Is $220 million a lot?
For GM, not really. The Register's headline calls it cracking "the petty cash box," and notes that $220 million is less than 7 percent of GM's $3.3 billion in net income attributable to stockholders for the third quarter of 2026, which ended September 30. On those numbers, the payment is a cost of doing business, not a threat to the business.
What GM has to change may last longer than the check. Besides the consent requirement, The Register reports that GM agreed to limit data collection, protect personally identifiable information (PII: data that identifies a specific person) and set up a comprehensive data privacy program. The Washington AG says the terms are significantly stronger than any other resolution reached with GM for this conduct, in part because they mandate internal and external privacy program assessments and dealership oversight and training.
This isn't GM's first settlement over Smart Driver
This multistate deal follows several earlier actions over the same program. AutoGuide reported in May 2026 that California Attorney General Rob Bonta reached a separate $12.75 million settlement with GM, subject to court approval, that includes a five-year ban on selling driving data to brokers. AutoGuide also notes that the program caused legal problems for GM in Texas in 2024 and drew an FTC investigation and agreement. The FTC described GM's handling of driver data as an "egregious betrayal of consumers' trust." In the California matter, GM said the settlement related to the discontinued Smart Driver product.
Put together, one discontinued feature has produced action from the FTC, Texas, California and now a 36-member coalition. Each settlement adds to a public record of what regulators consider unacceptable telematics practice. Telematics is the data a connected vehicle reports back about where it goes and how it's driven.
What It Means for Defenders
No software patch or CVE comes with this story. The thing to fix is how organizations collect and share data. These groups should pay attention:
- GM owners and drivers of GM vehicles from the 2016–2024 enrollment period. These are the people whose data the states say was collected and sold. The OnStar app's enrollment status can't be taken as proof: the states say it told more than 370,000 drivers they weren't enrolled when they were. If insurance pricing for you or your business changed in ways you couldn't explain during those years, this case may be why. The sources don't describe a claims process for individuals. The $12.3 million figure is Washington's share as a state.
- Fleet operators and small businesses running connected vehicles. Company cars send the same kind of telemetry, including location, speed and seatbelt use. Check which connected-vehicle services are switched on across the fleet, who enrolled each vehicle, and which third parties the vendor's terms let it share data with. Location histories for company vehicles can reveal customer sites, staff routines and travel patterns, which is a business-confidentiality risk on top of a privacy one.
- Privacy, compliance and product teams at any company that collects behavioral or location data. The settlement terms work as a checklist regulators now expect: affirmative express consent before collection or disclosure; data minimization, meaning you collect only what you need; internal and external privacy assessments; and oversight and training for third parties, such as resellers and dealers, who handle enrollment. If sales staff get incentives that reward sign-ups, or can accept terms for a customer, expect regulators to treat that as a consent failure.
- Anyone maintaining a "privacy status" screen. The OnStar finding is about whether a status display matches what the backend is actually doing. If your app or portal tells users what's being collected, test that against what actually leaves your systems. A dashboard that shows the wrong status is worse than no dashboard.
- Federal contractors and CMMC shops. This isn't a CMMC matter, but vehicle telemetry from staff who visit sensitive sites is location data that can leave the organization through vendor contracts nobody reviewed. It belongs in your third-party data-flow inventory.
The lesson goes beyond GM. Letting intermediaries do the clicking, and selling data to brokers that supply insurers, has now cost one company actions and settlements with the FTC, Texas, California and 36 attorneys general. The fines may be small next to GM's profits, but the consent requirements show the standard regulators will hold other companies to.
