What did GM agree to in the $220 million settlement?
General Motors agreed on Oct. 29, 2026, to pay $220 million and accept long-running privacy oversight to settle claims that it sold drivers' behavior and location data that ended up with insurers. The deal ends a multistate case led by Oregon and Washington.
The agreement takes the form of a stipulated general judgment filed in Multnomah County Circuit Court in Oregon. It names General Motors LLC, General Motors Holdings LLC and OnStar LLC as defendants. Thirty-six attorneys general signed on: 35 states plus the District of Columbia.
GM must pay the full amount within 30 days of a Nov. 30, 2026 effective date. The money is divided among the participating jurisdictions. Oregon receives $10,460,649 under the judgment, and Washington receives $12.3 million. Other states have their own allocations in separate judgments.
None of that money is earmarked for drivers. The judgment creates no restitution fund and no claims process for owners of affected vehicles. GM also admitted no facts or liability, and both sides waived their right to appeal.
The case arrived at court unusually quickly. Oregon filed its complaint on Oct. 28 and entered the judgment a day later, so the allegations were never tested at trial. The settlement resolves an investigation rather than a litigated dispute.
The Oregon document is one piece of a coordinated package. Its opening footnote says GM is simultaneously entering similar judgments with every participating jurisdiction. Each state enforces its own order, which is why the payout table differs from one attorney general to the next.
"People bought a car, not a tracking device," Oregon Attorney General Dan Rayfield said in a statement. He said the investigation found GM sold data after promising not to share it with insurers without permission.
GM framed the outcome as the closing of an old chapter. The company said the agreement "addresses Smart Driver, a product we ended in 2024" and "reinforces steps we've taken to strengthen our privacy practices."
How did Smart Driver data reach insurance companies?
Smart Driver began in 2015 as a free feature inside OnStar, GM's subscription safety and connectivity service. It rated habits such as hard braking, rapid acceleration, sharp cornering, speeding and seat-belt use, then showed drivers a score.
Enrollment usually happened at the dealership. Buyers signed up for Smart Driver and OnStar in one process, often while completing paperwork for the vehicle. The states say millions of drivers joined between 2016 and 2024.
The Oregon complaint traces what happened next. It alleges GM began selling OnStar and Smart Driver data to Verisk Analytics in 2015 and signed a similar contract with LexisNexis Risk Solutions in 2019. Both contracts specified insurance uses, according to the complaint.
The data was detailed enough to reconstruct routines. The complaint says GM collected precise geolocation every three seconds from ignition on to ignition off, beginning in 2018. Insurers could see how often someone drove, when trips started and ended, how hard they braked and whether they sped.
That detail is what made the records valuable. Insurers increasingly price policies with usage-based models, which reward low mileage and gentle driving and penalize risky patterns. A broker can turn a stream of trip data into a risk score without ever speaking to the driver.
Data brokers repackaged the material for insurers, which sometimes adjusted premiums. The complaint alleges GM earned more than $20 million nationwide from the data sales. That figure describes GM's revenue from the sales, not the premiums drivers paid.
The contracts are central to the states' theory. If a contract specified insurance use, the attorneys general argue, GM knew where the data was going even as its consumer messaging promised otherwise. That gap between the sales pitch and the sales contract is the heart of the deception claim.
The judgment treats insurance affiliates as a distinct category. It defines them as GM affiliates authorized to transact personal lines of property and casualty insurance for vehicles, which means data flowing inside the corporate family also falls under the consent rules.
GM discontinued Smart Driver in April 2024 and said customer feedback drove the decision. The move followed New York Times reporting, including an April 23, 2024 article by Kashmir Hill on how the company enrolled drivers.
What did the attorneys general say GM hid from drivers?
The attorneys general do not argue that collecting driving data is inherently illegal. Their case turns on disclosure and consent, and on what drivers were told when they bought a car.
According to the states, GM marketed Smart Driver as a safety tool and promised that data would not reach insurers without express permission. The complaint alleges the company sold identifiable data for every participant, including drivers who never joined a separate insurance-discount program.
Dealership incentives feature heavily in the complaint. The states say sales employees received bonuses tied partly to enrollment counts and that dealerships were ranked on sign-ups. In many cases, employees accepted terms and conditions on customers' behalf, the complaint alleges.
The states also cite a software error. The OnStar app told more than 370,000 drivers they were not enrolled when they were, while GM collected and sold their data, according to the complaint. GM found the problem after the Times reporting, removed those drivers from the program and did not tell them, the states say.
The distinction matters for the legal theory. A company can collect data and still face liability if it misdescribes the purpose or hides the audience. The states argue drivers consented to a safety dashboard, not to a pipeline feeding insurance pricing.
Rayfield said the result was financial harm for some owners. "Some drivers paid for it with higher premiums," he said. Washington Attorney General Nick Brown said drivers should control how their data is used, calling it "personal and valuable."
Because GM admitted nothing, the allegations remain contested in principle. The company has not conceded that its disclosures were misleading, and the judgment expressly says it does not constitute an admission of any fact or liability.
The company says its practices have already changed. GM said in a statement that it now focuses on protecting customer privacy, no longer sells vehicle information that can be linked to a person or a vehicle's location, and has updated its privacy policy. It may still share anonymized data that is not tied to an individual.
What changes for GM owners and car buyers?
The judgment rewrites how GM must handle driver data going forward. Before collecting, using or disclosing covered data, GM needs affirmative express consent from the driver. Each separate service or feature requires its own consent.
The definition of consent is strict. Silence, pre-ticked boxes, broad terms of use and interfaces that impair a user's choice do not count. Consent must follow a clear and conspicuous disclosure, and GM cannot bundle permission into unrelated paperwork.
There are narrow exceptions. GM does not need consent to share data with emergency responders, to answer a request made from inside the vehicle, or to handle safety issues. Those exceptions are spelled out in the judgment and do not cover marketing or insurance products.
GM must also limit collection to what is adequate and necessary for a disclosed purpose. It must publish a privacy notice describing data categories, purposes, retention periods and the kinds of third parties that receive data. A chief privacy officer will oversee the program and report to the board at least annually.
Before launching high-risk processing, GM has to complete a data protection assessment. The judgment defines high-risk activity as selling covered driver data where state law allows it and disclosing precise location to third parties, so new products face a documented review.
Independent checks are part of the deal. GM must complete an initial third-party assessment covering the first 365 days, then biennial assessments for four years. The reports go to the Washington attorney general. GM also must train dealership staff so customers are not enrolled without consent.
Paperwork is part of the remedy. GM must keep compliance records for at least five years, deliver copies of the judgment to its chief executive, general counsel and chief privacy officer, and train relevant employees at least once a year. It also must maintain an inventory of the driver data OnStar collects and passes to third parties.
The obligations are long-lived. The privacy program runs until Jan. 13, 2046, though several specific provisions expire 10 years after the effective date. The program must be in place within 180 days of Nov. 30.
The judgment covers retail Chevrolet, GMC, Cadillac and Buick vehicles owned or leased for personal use. Fleet, rental and government vehicles are excluded. Covered data includes precise location, braking and acceleration events, seat-belt use, late-night driving and radio listening when linked to a person.
Some limits matter. The judgment does not create a private right of action, does not apply to other automakers and does not require GM to compensate drivers. GM says it will no longer sell data linked to an individual, though it may still share anonymized data with partners.
The rules also cover data collected through GM's branded apps and any successor service with similar data collection. That matters because automakers frequently rename or fold connected services into new subscriptions, and a narrow definition would leave an easy loophole.
How does this compare with the FTC and California settlements?
The state case is one of three actions against GM over the same program. The Federal Trade Commission filed its complaint in January 2025 and finalized an order on Jan. 14, 2026.
That order runs for 20 years and bans GM from sharing covered driver data with consumer reporting agencies for five years. It also requires affirmative express consent, a way to request and delete data, a switch to disable precise location collection and an opt-out from data sharing. The commission approved the order by a 2-0 vote.
The FTC complaint alleged a misleading enrollment process and a failure to disclose the data sales, the same pattern the states describe. Both cases describe drivers who did not understand what they were joining when they activated OnStar services.
California reached its own settlement earlier in 2026. GM agreed to pay $12.75 million to resolve California's claims over the same program, according to The Verge. That case covered the Smart Driver program and similar consent failures.
The states say their terms go further than earlier resolutions. Oregon's release describes the consent, assessment and dealership-training requirements as stronger than any other GM settlement for the conduct. The 2046 end date gives the program unusual staying power.
The overlap raises a question about duplication. Three enforcers imposed overlapping conduct rules for the same data, with the FTC setting federal standards, California adding a separate monetary penalty and the states layering on local oversight and dealer requirements.
For consumers, the remedies differ. The FTC order provides individual data access, deletion and opt-out rights. The state judgment focuses on consent, minimization and audits. Neither creates a direct payment for drivers.
Which other carmakers could face similar scrutiny?
The case is a template for the connected-car industry. Modern vehicles generate location, speed, braking and diagnostic data, and insurers have a commercial interest in that material. GM is not the only manufacturer selling or sharing it.
Other automakers face the same questions. The states built their case on consumer-protection law because much of the conduct predates newer privacy statutes. Oregon noted that its Unlawful Trade Practices Act covered conduct before the Oregon Consumer Privacy Act took effect in July 2024.
That legal route is available in most states. Attorneys general do not need a new privacy law to pursue deceptive enrollment or undisclosed data sales. The $220 million figure gives them a benchmark when negotiating with other manufacturers.
The politics are unusually broad. Brown described the outcome as "a bipartisan agreement holding GM accountable" for misusing drivers' data. A coalition that spans both parties is harder for a single company to dismiss as a local enforcement priority.
Enforcement will be the test. Watch the third-party assessments sent to Washington, the first of which covers the year after the effective date. Watch whether other states open inquiries into telematics programs. Watch, too, whether insurers keep buying driving data from other sources.
The dealer channel deserves attention. The complaint describes a sales culture that rewarded enrollment, and the judgment requires training and oversight at dealerships. Franchised dealers sit outside GM's direct control, which makes compliance harder to verify.
For drivers, the practical steps are limited but real. Owners can review OnStar and app settings, ask GM for a copy of their data and request deletion under the FTC order, and check whether their state offers broader rights.
The larger question is whether consent-based rules change behavior. GM can still disclose anonymized data, and insurers can still buy telematics feeds from other firms. The settlement raises the cost of ignoring drivers, but it does not end the market for driving data.