General Motors (GM) has agreed to pay $220 million to resolve a multistate lawsuit accusing the automaker of improperly selling customers’ private driving behavior and vehicle location data to third parties, including data brokers that provided the information to insurance companies.
The settlement, announced on October 29, 2026, follows an investigation involving attorneys general from 35 states and the District of Columbia.
Oregon and Washington led the bipartisan coalition, which alleged that GM violated consumer privacy promises by sharing sensitive driving information without obtaining proper permission.
According to state officials, insurance companies used some of the information to evaluate motorists’ driving habits and determine auto insurance premiums, potentially resulting in higher rates for certain drivers.
“People bought a car, not a tracking device,” Oregon Attorney General Dan Rayfield said in a statement announcing the agreement.
Why General Motors Faced a $220 Million Data Privacy Lawsuit
The allegations primarily concern GM’s Smart Driver program, which operated from 2016 until 2024 and enrolled millions of motorists.
GM marketed Smart Driver as a service designed to help customers become safer drivers by providing feedback about their driving behavior.
However, state investigators alleged that the company shared participants’ information with data brokers despite telling customers that their information would not be provided to insurance companies without their express permission.
The brokers subsequently sold the information to insurers under arrangements involving insurance-related products, according to the attorneys general.
The data reportedly included how frequently drivers used their vehicles, when individual trips started and ended, instances of hard braking, rapid acceleration and driving above posted speed limits.
This information provided insurers with detailed insights into motorists’ everyday driving patterns.
How GM’s Smart Driver Program Allegedly Collected Customer Information
Many customers were enrolled in Smart Driver when purchasing their vehicles at GM dealerships.
The enrollment process was combined with registration for OnStar, GM’s connected vehicle service offering safety, navigation and diagnostic features.
State investigators alleged that dealership employees sometimes accepted terms and conditions on behalf of customers without obtaining their informed consent.
Dealerships were also encouraged to increase enrollment in connected vehicle services through incentives and performance rankings, according to the coalition.
The investigation identified another significant problem involving GM’s OnStar application.
More than 370,000 drivers were reportedly shown as not enrolled in Smart Driver, even though their driving information was being collected and shared.
State officials alleged that GM subsequently removed those drivers from the program without informing them about the earlier enrollment and data-sharing issues.
Also Read: Notorious B.I.G. Estate Lawsuit: Faith Evans Ordered to Pay Nearly $14 Million
Did Insurance Companies Use GM Driver Data to Increase Premiums?
One of the biggest concerns surrounding the GM data privacy lawsuit is the potential financial impact on motorists.
Insurance companies increasingly use telematics technology to evaluate driving behavior. These programs monitor factors such as mileage, braking patterns, acceleration and driving frequency to assess risk.
Insurers including Allstate, Progressive and Geico offer programs that can reward eligible drivers with lower premiums for safer driving habits.
However, the allegations against GM raised concerns about customers’ driving information being shared with insurance companies without their knowledge or meaningful consent.
According to state officials, insurers could use the information to adjust premiums, sometimes increasing insurance costs for certain motorists.
The controversy highlights an important distinction: drivers who voluntarily participate in an insurance monitoring program may understand how their information is used, while customers whose data is shared without adequate disclosure may have little opportunity to make an informed decision.
What Does the $220 Million GM Settlement Require?
Under the agreement, General Motors must strengthen its privacy practices and obtain affirmative, express consent before collecting or sharing covered driving behavior and location information.
The settlement also requires the automaker to:
- Limit the amount of driving information it collects from customers.
- Obtain clear permission before collecting or disclosing covered driving and location data.
- Establish a comprehensive data privacy and protection program.
- Conduct internal and independent external assessments of its privacy safeguards.
- Strengthen dealership oversight and employee training to prevent customers from being enrolled in data collection programs without proper consent.
These requirements are intended to give motorists greater control over the personal information generated by their connected vehicles.
GM said the agreement addresses Smart Driver, a product it discontinued in 2024, and reinforces steps the company has already taken to strengthen customer privacy.
The automaker also stated that connected vehicle information can support safer and more personalized experiences, while emphasizing its commitment to transparency about what information is collected, how it is protected and what choices customers have.
The settlement resolves the states’ allegations and does not constitute an admission of liability by GM.
Will GM Drivers Receive Compensation From the $220 Million Settlement?
Drivers should not assume they will receive a direct payment from the $220 million agreement.
The settlement provides payments to participating states rather than direct consumer restitution.
For example, Oregon is expected to receive more than $10.4 million, while Michigan will receive approximately $7.2 million.
However, a separate nationwide private class-action lawsuit seeking monetary relief remains pending, according to Michigan Attorney General Dana Nessel’s office.
Consequently, the multistate settlement does not automatically establish that individual GM drivers are eligible for compensation.
GM’s Latest Settlement Follows Earlier Privacy Actions
The $220 million agreement is not the first regulatory action involving General Motors and customer data.
In January 2025, the Federal Trade Commission finalized an order addressing allegations that GM and OnStar collected and sold consumers’ precise location and driving behavior information without adequately informing them or obtaining affirmative consent.
The FTC order prohibits GM from disclosing certain vehicle location and driving behavior information to consumer reporting agencies for five years.
It also requires stronger consumer privacy protections, including mechanisms for accessing and requesting deletion of personal data.
Additionally, in May 2026, GM agreed to pay $12.75 million to resolve a separate California investigation into the alleged sale of driver information to two data brokers.
Together, these developments illustrate the growing regulatory scrutiny facing automakers as connected vehicle technology becomes increasingly common.
For American motorists, the GM case raises a broader question about vehicle ownership and digital privacy: How much personal information should car manufacturers be allowed to collect, and who should be able to access it?
As vehicles become more connected, transparency, informed consent and stronger data protection practices are likely to remain major consumer concerns.
