GM's $220M Driver Data Settlement: What Changes for Drivers

By Jaspal Singh October 30, 2026 Updated: October 30, 2026

General Motors will pay $220 million to 35 states and Washington, D.C., to settle claims that it sold drivers' braking, speeding and location data, collected through its OnStar Smart Driver feature, to data brokers whose reports insurers used to set premiums. The deal adds consent rules, outside privacy audits and dealer training to an existing federal ban.

What Happened

On October 29, 2026, a coalition of state attorneys general announced that GM had agreed to pay $220 million to resolve their investigation into the Smart Driver program. Washington and Oregon co-led the case. An executive committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont helped run it, and more than twenty other states plus the District of Columbia joined. Arizona's share is $5.9 million, according to the Arizona Attorney General's announcement.

The states say that from 2016 to 2024 GM enrolled millions of drivers in Smart Driver, a free feature in its connected-car apps that rated how people drove. According to the Arizona release, the program recorded the number of trips, the start and end time of each drive, counts of hard braking and rapid acceleration, speeding above the posted limit, and location. GM then sold that data to third parties, including data brokers, who sold it on to insurers. The insurers used it, in part, to set or change premiums, and sometimes to raise them.

The attorneys general also allege that GM told drivers it would not share data with insurers without their express consent, while doing exactly that. They say GM paid incentives to dealerships and salespeople to sign customers up for OnStar, and that dealership staff accepted the terms on customers' behalf. The OnStar app told more than 370,000 drivers that they were not enrolled in Smart Driver when they were. GM later unenrolled them without telling them about the error, which left their data already in the hands of brokers and insurers.

The case traces back to a March 2024 New York Times investigation that named LexisNexis Risk Solutions and Verisk as the brokers receiving GM data. GM ended Smart Driver in 2024. In January 2026 the Federal Trade Commission finalized its own order against GM and OnStar, and in May 2026 GM paid $12.75 million in a separate California settlement. TechCrunch reported that GM's statement describes the deal as addressing "a product we ended in 2024."

Why It Matters

This is the largest payment so far in the connected-car data scandal, and it lands on a company that already had a federal order against it. The FTC order mostly controls what GM may do next. The state settlement puts a price on what GM already did and adds tools the FTC order lacked, such as mandated outside assessments of GM's privacy program and rules for the dealers who signed customers up.

It also matters because of who was hurt and how. Most Smart Driver users never saw a "sell my data to insurers" screen; many first learned about it from a higher insurance quote. A driver who brakes hard to avoid a collision looks, in the data, like a driver who brakes hard because they tailgate. The states' complaint is not only that the data was sold, but that it was sold without the context or consent that would let drivers decide whether the trade was worth it.

Finally, it sets expectations for the rest of the industry, where nearly every new car now ships with a cellular modem. The settlement's central rule, affirmative express consent before collecting or sharing driving and location data, is a template regulators can now point to when they look at other brands.

How It Works

The data pipeline behind Smart Driver had four links, a structure common across the connected-car market.

1. The car collects. A GM vehicle with OnStar has a telematics control unit: a small computer with a cellular modem and GPS receiver that reads data from the car's internal network. It can see speed, acceleration, braking force, ignition on and off, and position. The same hardware powers crash notification and remote start.

2. The carmaker scores. Smart Driver took those raw signals and turned them into behavior events: a hard brake, a rapid acceleration, a stretch above the speed limit, a drive late at night. The app showed drivers a score and tips. That was the part customers saw.

3. The broker packages. The part customers did not see was the sale. A data broker that receives trip-level records can match them to a person through the vehicle identification number and account details, then build a driving-history report. Because brokers such as LexisNexis operate as consumer reporting agencies, these reports sit alongside the claims and motor-vehicle records insurers already buy.

4. The insurer prices. When a driver asks for a quote or comes up for renewal, the insurer can pull that report. Frequent hard braking or late-night trips can push a premium up. Under the Fair Credit Reporting Act, an insurer that charges more because of a consumer report generally has to send an adverse action notice that names the agency, which is how many drivers eventually traced their rate increases back to GM.

The settlements cut this chain at different points. The FTC order, approved on a 2-0 vote and announced January 14, 2026, bans GM from disclosing geolocation and driver-behavior data to consumer reporting agencies for five years, which blocks link three. For the order's full 20-year life, GM must get affirmative express consent before collecting, using or sharing connected-vehicle data, with narrow exceptions such as giving location to emergency responders. It must also let every U.S. consumer request a copy of their data and ask for its deletion, let owners turn off precise location collection where the hardware allows, and offer an opt-out from location and driving-behavior collection.

The California settlement reached in May 2026 adds a five-year ban on selling driving data to any consumer reporting agency, explicitly including Lexis and Verisk, and requires GM to delete retained driving data within 180 days unless a customer consents. The multistate settlement now requires limits on what driving data GM collects in the first place, a comprehensive privacy program, internal and external assessments of that program, express consent before collecting or disclosing driving and location data, and oversight and training for dealerships so staff cannot click through consent for buyers.

GM says it no longer sells vehicle information linked to an individual, vehicle location or driving behavior, though it may still share anonymized data with partners. It has also set up a GM Privacy Center where owners can manage their data choices.

If you drove a GM vehicle with OnStar between 2016 and 2024, the practical steps are simple. Request your consumer disclosure file through the LexisNexis consumer portal, which also accepts opt-out and deletion requests, and dispute any driving records you do not recognize. Check whether your insurer ever sent you an adverse action notice. Then review the connected services settings in your current car's app, whatever brand it is.

What's Still Unknown

Several important details were not in the announcements. The states have not said how the $220 million will be used. Neither the Arizona release nor the news coverage mentions restitution checks for individual drivers, so anyone hoping for a payout should not expect one from this deal unless a state announces otherwise.

The duration of the new consent, assessment and dealer-training terms has not been published, and the identity of the outside assessor is not public. It is also unclear whether GM admitted any wrongdoing, which affects private class actions still moving through the courts.

Texas, which sued GM in August 2024 over the same conduct, is not on the coalition list, and its case is separate. California settled on its own.

The biggest open question is how the rules will apply to GM's next generation of features. The OnStar AI assistant announced in October will use vehicle cameras for live views and safety recordings. GM says those recordings are time-limited and encrypted. Whether camera data counts as "driving data" under these settlements, and what consent screens owners will see, will only become clear once the feature ships.

Frequently Asked Questions

Will GM drivers get money from the $220 million settlement?

Not automatically, based on what has been announced. The Arizona Attorney General's release lists Arizona's $5.9 million share but does not describe payments to individual drivers, and the coverage so far does not mention restitution. States usually decide how to use their portion. If your state sets up a claims process, its attorney general's office will announce it, so check there rather than responding to emails or texts promising payouts.

What driving data did GM's Smart Driver collect?

According to the attorneys general, Smart Driver recorded the number of trips you took, the start and end time of each drive, how often you braked hard or accelerated rapidly, when you drove above the speed limit, and your location. GM then sold that data to third parties, including data brokers, who sold it to insurance companies. Insurers used it in part to set or change premiums, sometimes raising them.

Which states are part of the GM settlement?

Washington and Oregon co-led the case, with Arizona and an executive committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont. Alabama, Alaska, D.C., Florida, Hawaii, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia and Wisconsin also joined. California and Texas pursued their own cases.

How can I find out if my driving data was sold to an insurer?

Request your consumer disclosure report from LexisNexis Risk Solutions through its consumer portal, and check any adverse action notice your insurer sent when it raised a rate or denied coverage. Those notices must name the consumer reporting agency used. If you find trip records you did not agree to share, you can file a dispute with the agency and ask it to delete them.

Is GM still allowed to collect driving data?

Yes, but only under tighter rules. The FTC order requires affirmative express consent before GM collects, uses or shares connected-vehicle data for 20 years, with narrow exceptions such as emergency response. The multistate deal adds limits on what driving data GM collects and requires the same express consent. GM also says it no longer sells data linked to individuals, though it may share anonymized data.

How is this different from the FTC order against GM?

The FTC order, finalized January 14, 2026, controls GM's future conduct: a five-year ban on sharing driving data with consumer reporting agencies and 20 years of consent, access and deletion rights. The states' settlement adds a $220 million payment for past conduct, mandated internal and external privacy assessments, and training and oversight for dealerships that enrolled customers. The two agreements run side by side rather than replacing each other.

Do other carmakers share driving data with insurers?

Most new cars have a cellular connection and can record speed, braking and location, and some carmakers have offered opt-in insurance or usage-based programs. Practices vary by brand and change over time, so the safest approach is to read the connected services settings in your car's app, turn off anything you do not use, and request your report from consumer reporting agencies that hold driving histories.