About

GM agrees to pay $220M to 36 states over selling driver data to insurers via brokers

Published
Score
15

Why it matters

General Motors will pay $220 million to resolve a multistate investigation into its Smart Driver program, which collected and sold drivers' driving and location data. Washington and Oregon led a coalition of 36 state attorneys general. Washington's share is $12.3 million. Washington Attorney General Nick Brown and Oregon Attorney General Dan Rayfield announced the deal. Under the settlement, GM must obtain drivers' express consent before collecting or sharing driving and location data, and it must limit how much driving data it gathers. The money goes to the states, not individual drivers, and GM did not admit wrongdoing.

The alleged conduct ran from 2016 to 2024. Smart Driver was offered at dealerships during vehicle purchases and bundled into OnStar registration. The OnStar mobile app incorrectly told more than 370,000 drivers they were not enrolled while their data continued to be collected. According to the attorneys general investigation, GM sold the data to brokers under contracts that described insurance uses. GM did not tell drivers their data would be used that way. Brokers then supplied insurers, which used the records in setting premiums. One outlet reports a driver saw a 22 percent premium increase, a figure that appears in no other source reviewed. Earlier reporting by The New York Times identified data brokers LexisNexis and Verisk among the third parties receiving the data. GM ended the program in June 2024. The Federal Trade Commission separately barred GM from sharing certain driver data with consumer reporting agencies for five years. The date of that FTC order is not settled across sources, with some citing January 2025 and others January 2026. A separate $12.75 million California settlement was reached in May 2026. Texas, which sued GM in 2024, is not part of this deal.

The settlement's exact terms beyond the consent and collection limits have not been published in full, and the date of the FTC order remains unresolved in public reporting. The 10.3 million affected-customer figure circulated in one outlet, Startup Fortune, and is excluded here because no other source confirms it.

For attorneys, this deal adds binding, multistate privacy obligations on top of federal and state actions already in place, which makes it a useful template for consent requirements in connected-vehicle data cases. Watch for the consent and data-minimization terms to be cited in future enforcement against automakers and brokers. The lack of direct restitution to drivers may draw private litigation or continued public pressure, particularly from consumers who were charged higher premiums. Counsel advising insurers or data brokers should review how telematics data sourced from automakers is documented and disclosed. The Texas suit remains open and is worth tracking separately.

Sources

mail Subscribe to Privacy email updates

Primary sources. No fluff. Straight to your inbox.

Also on LawSnap