GM Driver Data Settlement: $220M and What Owners Can Do

General Motors will pay $220 million over a sign-up that happened at the dealership. It was meant to activate OnStar. It also enrolled millions of drivers in a program that recorded every hard brake, every trip past the speed limit, and every late-night drive. GM then sold that record to data brokers, which supplied it to insurers. For years, most owners never knew.

That practice led to the GM driver data settlement announced on October 29, 2026. General Motors will pay $220 million to a coalition of 36 attorneys general. The states allege that GM's OnStar Smart Driver program collected and sold drivers' location and driving behavior data from 2016 to 2024 without proper consent. GM settled without admitting the allegations. No driver gets a check. Drivers do get the right to say yes or no before their data is collected, to see their data, and to ask for it to be deleted.

What is the GM driver data settlement?

General Motors is paying $220 million to a bipartisan coalition of 36 attorneys general, co-led by Oregon Attorney General Dan Rayfield and Washington Attorney General Nick Brown. The deal resolves allegations that GM sold drivers' private driving behavior and location data to data brokers. The brokers then sold it to insurance companies, which used it in part to set rates.

A data broker buys personal information from one source and sells it to others. In this case, the brokers named in the related California settlement were LexisNexis Risk Solutions and Verisk Analytics, both major suppliers of consumer reports used by insurers.

The money is split among the participating states. According to the Oregon Department of Justice, Oregon will receive more than $10.4 million. North Carolina's share is $7,657,771, according to the North Carolina Department of Justice. KIRO 7 reported that Washington will receive $12.3 million.

Rayfield said: "People bought a car, not a tracking device." North Carolina Attorney General Jeff Jackson put it more bluntly. "General Motors told drivers it would keep their data private - it lied," he said in his announcement. He then repeated the charge about permission: "It told drivers it wouldn't share their data without their permission - it lied."

Those are allegations; GM did not admit them. Its position, from a spokesperson speaking to MyNorthwest: "This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices."

What did GM's Smart Driver program collect, and who bought it?

Smart Driver ran from 2016 to 2024 and enrolled millions of drivers, according to the states' announcements. GM pitched it as a safety tool: drivers could see their habits and drive more safely. The data behind that pitch was specific enough to price an insurance policy.

The states and the FTC describe the collected data points as:

How many times a person drove
The start and end time of each trip
How often the driver braked or accelerated hard
Whether the driver went over the speed limit, including driving over 80 mph
Late-night driving
Precise location, collected sometimes as often as every three seconds, according to the FTC

GM told drivers it would not share this data with insurers without their express consent. The attorneys general say GM sold the information to data brokers under contracts specifying that it would be used for insurance products. Those brokers sold it to insurance companies, which used it in part to set premiums. According to the coalition's announcement, GM never told drivers about that use. GM ended Smart Driver in 2024, after The New York Times reported on the practice.

How were drivers enrolled without knowing?

Most people who ended up in Smart Driver never chose it. According to the Oregon Department of Justice, they were enrolled at the dealership when they bought the car, through a sign-up that also activated GM's OnStar connected services.

The states allege dealership employees accepted terms and conditions on customers' behalf without consent. Sales staff earned bonuses partly based on enrollment numbers, and GM ranked dealerships by enrollment.

The app made things worse. It wrongly told more than 370,000 drivers they weren't enrolled in Smart Driver, even as GM collected and sold their data. GM later quietly unenrolled those drivers without telling them about the mistake. Their data stayed with brokers and insurance companies.

The FTC, in its own complaint, called the enrollment process confusing and misleading. It said some consumers didn't know they had been signed up for Smart Driver at all.

What does the $220 million settlement require GM to do?

According to the Oregon and North Carolina announcements, GM must:

Get clear permission first. GM must obtain drivers' affirmative, express consent before collecting or sharing their driving and location data. That means an actual yes from the driver, not a pre-checked box or an employee clicking through on their behalf.
Collect less. GM must limit the driving data it gathers and protect consumers' personal information through a comprehensive data privacy program.
Submit to assessments. The company must undergo internal and external assessments of that program.
Fix the dealership pipeline. GM must put oversight and training in place at dealerships so customers aren't signed up for data collection without their consent.

Drivers won't receive any of the money. There is no claims process, refund form, or class action payout in this settlement. The $220 million goes to the states. The Oregon and Washington attorneys general said the terms are "significantly stronger" than any other resolution reached with GM over this conduct.

How does the state settlement fit with the FTC order and the California case?

Three separate actions now limit what GM can do with driver data. Each adds requirements.

Action	Date	Key terms
State settlement, 36 AGs	Oct. 29, 2026	$220 million to states; affirmative express consent; dealership oversight
FTC final order	Jan. 14, 2026	20-year order; five-year ban on disclosing data to consumer reporting agencies
California settlement	May 9, 2026	$12.75 million in civil penalties; 180-day deletion; five-year ban on sales to consumer reporting agencies

The Federal Trade Commission finalized its order in January 2026 on a 2-0 vote, after proposing it in January 2025. The FTC's final order runs for 20 years. It requires GM to obtain affirmative express consent before collecting, using, or sharing connected vehicle data, with limited exceptions such as sending location data to emergency first responders. The order also bars GM for five years from disclosing geolocation and driver behavior data to consumer reporting agencies. GM must let all U.S. consumers request a copy of their data and seek its deletion, and give them a way to opt out of geolocation and driver behavior collection. The FTC called GM's conduct an "egregious betrayal of consumers' trust."

California handled its case separately. In May 2026, California Attorney General Rob Bonta announced a deal requiring GM to pay $12.75 million in civil penalties, according to TechCrunch. GM must stop selling driving data to consumer reporting agencies for five years. It must delete retained driver data within 180 days unless it obtains consent, and ask LexisNexis and Verisk to delete the data they hold. Bonta's office alleged GM sold data on hundreds of thousands of Californians and made roughly $20 million from the sales. All three actions are settlements, not court findings that GM broke the law.

Did your car insurance go up because of GM data?

You can't tell without asking. The states allege insurers used GM's data to set premiums for some drivers. The FTC's complaint says consumer reporting agencies used it to compile reports that insurers relied on to set rates or deny coverage. California's case was different: Bonta's office said the data did not lead to increased insurance prices there, because state law prohibits insurers from using driving data to set rates.

If you suspect your rate reflects GM's data, start with your premium documents and renewal notices. Insurers don't always say which data sources shaped a rate. Many consumers were unaware of the data sharing and complained to GM only after finding out, according to the FTC. Ask your insurer whether driving behavior data played a role in your rate, and use the steps below to check what is in your file.

How can GM owners see and delete their data?

Three steps are open to every owner at no cost, and GM agreed to them under the FTC order and state settlements.

Request your data from GM. The FTC's final order requires GM to let any U.S. consumer request a copy of their data and seek its deletion. GM's privacy statement says it accepts requests through its U.S. Consumer Privacy Request Form or by phone at 1-866-MYPRIVACY (1-866-697-7482). GM does not accept privacy requests by email, so use the form or call.

Pull your LexisNexis consumer disclosure. LexisNexis Risk Solutions is one of the data brokers named in the California case, and it provides a consumer disclosure report under the Fair Credit Reporting Act. Under 15 U.S.C. § 1681j(a)(1)(A), nationwide consumer reporting agencies and nationwide specialty agencies must provide your file disclosure once during any 12-month period without charge. Request it, read it, and dispute anything wrong, using the same dispute rights that apply to a credit report. Then ask your insurer whether it used driving behavior data from a consumer report to set your rate.

Turn off collection at the source. The FTC order requires GM to let consumers opt out of geolocation and driver behavior data collection, and to disable precise location collection where the vehicle's technology allows it. Check the OnStar app settings and your vehicle's privacy options, then opt out of anything you don't want recorded.

The settlement cannot undo eight years of data sales, but it does hand drivers the tools to find out what was collected and to shut the pipeline off.

Frequently asked questions

Will I get a check from the GM settlement?

Not from this one. The $220 million goes to the 36 participating states, and drivers get no payment or claims process. Washington receives $12.3 million, Oregon more than $10.4 million, and North Carolina $7,657,771. Drivers can request their data, seek its deletion, and opt out of collection under the FTC order.

Is Smart Driver still running?

No. GM ended the program in 2024, after The New York Times reported on it. A GM spokesperson said the agreement "addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices." The data already sold may remain with brokers and insurers, which is why the FTC's access and deletion requirements matter.

Does the settlement cover other automakers?

No. The FTC's order names General Motors LLC, General Motors Holdings LLC, and OnStar LLC, all owned by General Motors Company, and the FTC called it its first action related to connected vehicle data. The $220 million state settlement binds only GM. If you drive something other than a Chevrolet, Buick, GMC, or Cadillac, these terms don't apply to your automaker.

What if I never had OnStar?

You may still have been enrolled. The settlement announcements say enrollment happened at the dealership through a sign-up that bundled OnStar and Smart Driver, and dealership staff allegedly accepted terms on customers' behalf. If you bought a GM vehicle between 2016 and 2024, submit a privacy request to GM and ask what data exists for you and whether Smart Driver was active.

Sources

This article is general legal information about consumer privacy and the GM driver data settlements, not legal advice. Privacy rights, data access rules and insurance rating laws can depend on your state and your situation. For advice on your situation, contact a consumer attorney or legal aid office licensed in your state.

Featured image: photo by Volodymyr Proskurovskyi on Unsplash.