GM Reaches $220 Million Settlement Over Driver Data
General Motors reached a multistate $220 million settlement over allegations that it sold drivers’ driving and location data without sufficiently explicit consent.
GM’s settlement with a coalition of 36 U.S. state attorneys general concerns allegations of unlawful sales of drivers’ driving and location data. According to officials, GM must pay the states a total of $220 million and change its rules for collecting and sharing this data.
The attorneys general of Oregon and Washington confirmed the settlement. The dispute does not concern a cyberattack or data breach, but rather how the automaker handled telematics data from connected vehicles and provided it to other companies.
GM Settlement and the Smart Driver Program
State authorities say the Smart Driver program collected identifiable information about driver behavior and location from 2016 through 2024. According to their findings, GM provided this data to data brokers, who then sold it to insurers.
The attorneys general claim that insurers used the data at least in part when setting insurance rates. However, the available materials do not show what share of any specific increase in individual drivers’ premiums can be directly attributed to this data.
According to secondary reporting, GM ended the Smart Driver program in 2024. The settlement also does not constitute a final court ruling that the automaker violated the law. An Oregon court document expressly states that GM agreed to the terms without admitting the alleged facts or legal liability.
Explicit Consent Instead of General Terms
A key part of the settlement is a requirement for the consumer’s explicit affirmative consent before GM begins collecting or disclosing driving and location data. The terms are intended to limit the use of precise location data and driving habits without a separate informed decision by the customer.
GM must implement a comprehensive privacy program. It includes internal and external assessments, oversight, and training also intended for dealers.
For drivers, it is important to distinguish between a vehicle function that requires data processing and separate consent to collect or share telematics data for additional purposes. The multistate settlement focuses specifically on the form of that consent, not on technically securing vehicles against an external attack.
What Happens Next
The Oregon document states that the judgment there will take effect on November 30, 2026. The formal entry and enforceability of parallel settlements in the other jurisdictions involved in the coalition still need to be monitored.
The practical details of the privacy program will also be important: the scope of external audits, oversight of dealers, and how the automaker will request affirmative consent in apps or vehicles. The Texas attorney general’s separate case against GM is also continuing, as reported by secondary media.
The case is among the broader multistate actions involving privacy protections for connected cars. It shows that telematics data can be commercially useful beyond the vehicle’s operation itself and that regulators are examining not only its transfer but also how customer consent is obtained.
Sources
- Oregon Department of Justice – announcement – Confirms the $220 million amount, the coalition of 36 states, the explicit-consent requirement, and the main remedial measures.
- Oregon Circuit Court – Stipulated General Judgment and Money Award – Documents the terms of the Oregon settlement, the lack of an admission of liability, the definition of active explicit consent, and the November 30, 2026 effective date.
- Office of the New York Attorney General – announcement – Corroborates the scope of the data, investigators’ claims, and GM’s obligations under the multistate settlement.
- The Record – Provides independent confirmation of the settlement and GM’s statement that it ended Smart Driver in 2024.
Verified and updated: October 30, 2026 06:30
