General Motors has agreed to a GM $220 million privacy settlement with attorneys general from 35 states and the District of Columbia over allegations tied to its discontinued Smart Driver program. The coalition said GM collected driving-behavior and location data, sold it to data brokers and failed to tell drivers it would be used for insurance products. The brokers then sold the information to insurers, which could use it when setting premiums.
The agreement, announced October 29, resolves allegations rather than a finding of liability. Washington Attorney General Nick Brown and Oregon Attorney General Dan Rayfield led the bipartisan coalition of 36 attorneys general. Washington is set to receive $12.3 million, according to Brown's office.
Smart Driver operated from 2016 through 2024 and enrolled millions of people, according to Reuters and the Washington attorney general. GM marketed the feature as a way for drivers to monitor and improve driving habits, while telling participants it would not share their information with insurers without express consent, the state investigation said.
What data did GM's Smart Driver program allegedly share?
The Washington attorney general said the records were identifiable and granular: trip counts, departure and arrival times, hard braking and acceleration events, speeding and location information. Its investigation found that GM's agreements with data brokers specified insurance-product use. Insurers could use the data to adjust a driver's premium, which could mean higher rates in some cases.
For many customers, enrollment came at a dealership during the same sign-up flow used for OnStar, GM's safety, navigation and diagnostic service. The Washington attorney general alleged that dealership employees sometimes accepted the terms for customers without their consent. Dealerships had incentives to add customers to connected-vehicle services, the office said, including employee bonuses and rankings linked in part to enrollment counts.
The state also described a particularly ugly systems problem: the OnStar app incorrectly told more than 370,000 drivers that they were not in Smart Driver while GM was collecting and selling their data. The attorney general said GM later removed those drivers from the program without telling them about the error, while their information remained with brokers and insurers.
What must GM change under the settlement?
GM must obtain affirmative, express permission before collecting or disclosing consumers' driving and location data. The settlement also limits collection, requires a broader privacy program, and calls for internal and outside assessments of data protection and privacy practices. GM also agreed to dealership oversight and training meant to prevent consumers from being enrolled in data collection without consent, according to the Washington attorney general's announcement.
GM said connected-car data can support safer, more useful and personalized services, and said it is committed to making clear what data it uses, how it protects it and what choices customers have.
The multistate case is separate from earlier action over the same broad data practices. Reuters reported that GM agreed in January 2025 not to provide vehicle geolocation and driver-behavior data to consumer-reporting agencies for five years under an agreement with the Federal Trade Commission. In May 2026, it agreed to pay $12.75 million to resolve a California investigation into alleged sales of driver data to two brokers.
This story draws on original reporting from Reuters.
