GM to Pay $220 Million to 35 States and DC Over Sale of Driver Data, Admits No Wrongdoing

General Motors will pay $220 million to settle a lawsuit from the attorneys general of 35 states and the District of Columbia. They alleged the automaker sold drivers' private behavior and location data to brokers, who resold it to insurance companies.

The settlement was announced Thursday, Oct. 29. GM did not admit wrongdoing.

What the states alleged

The case centers on Smart Driver, a feature GM offered inside its connected-car and OnStar apps from 2016 until it shut the program down in 2024. Millions of drivers were enrolled.

The states say GM pitched it as a way to improve personal driving safety and promised not to share data with insurers without permission. According to the coalition, GM then sold the data to brokers anyway. The brokers were data firms including LexisNexis and Verisk, per a March 2024 New York Times investigation that first exposed the practice.

Washington Attorney General Nick Brown said the data was specific. "Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit," he said.

Oregon Attorney General Dan Rayfield put it more bluntly: "People bought a car, not a tracking device."

Enrollment at the dealership

Most drivers signed up at the dealership while buying a car. The attorneys general allege dealership employees got bonuses for enrolling customers, and that GM ranked dealerships against each other by enrollment numbers.

The states also allege that GM's OnStar app told more than 370,000 drivers they were not enrolled in Smart Driver when they actually were. GM later unenrolled those drivers, the states say, without telling them. The data already collected was allegedly never pulled back from brokers and insurers. These are the coalition's allegations. GM did not admit them in the settlement.

The Times reported in 2024 that some drivers saw their insurance rates rise with no accidents on their records, and some struggled to find an insurer at all.

GM's position

A GM spokesperson said the agreement "addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices." The company said it is "committed to being clear about what information is used, how it's protected, and the choices customers have about what they share."

GM also says it has simplified its privacy statement and now offers a consumer-facing Privacy Center. It says it will no longer sell vehicle information linked to an individual, a vehicle's location, or how someone drives. It may still share anonymized data not tied to an individual with certain partners.

The broader insurance industry defends the underlying technology. Insurers such as Allstate, Progressive and Geico use telematics to monitor driving habits. They say it rewards good driving with lower premiums. The dispute here is not whether telematics exists. It is whether drivers knew and agreed to what was happening with their data.

What GM has to do

Under the settlement, GM must:

• Limit the driving data it collects.
• Get drivers' express consent before collecting or sharing driving and location data.
• Submit to an assessment by a third party of its compliance with the privacy program it has put in place.

The consent terms match earlier agreements with the Federal Trade Commission and California. The outside compliance review is a new requirement in this deal.

A string of settlements

This is not GM's first bill for the program. In January 2025, GM agreed with the FTC not to disclose vehicle geolocation and driver behavior data to consumer reporting agencies for five years. The FTC order also requires GM to give consumers a way to request deletion of their data. The agency has since finalized it. In May, GM agreed to pay $12.75 million to resolve a California investigation into its alleged sale of driver data to two data brokers.

The coalition was bipartisan. Democrats Rayfield and Brown co-led it. Attorneys general from Alabama, Massachusetts and Pennsylvania joined, and Ohio's Andy Wilson, a Republican, publicly touted the result alongside Democrats including Virginia's Jay Jones, Colorado's Phil Weiser and New York's Letitia James. Jones said his office is "proud to defend Virginians' privacy rights."

Texas is not part of this settlement. It sued GM in 2024 over the program, and that lawsuit is ongoing.

What comes next

GM is moving further into software-driven vehicles. It is adding a personal AI assistant to OnStar, its 30-year-old safety and roadside assistance service. Every new feature that rides on in-car data now comes with the consent rules and outside compliance check that this settlement imposes. How that third-party review is conducted, and who sees its findings, will determine whether the promises in the agreement are verifiable.