General Motors will pay $220 million to settle claims from 36 attorneys general that it sold drivers’ driving behavior and location data to data brokers, who passed it on to insurers. Oregon Attorney General Dan Rayfield announced the deal on October 29, 2026. Oregon and Washington led the coalition, and Oregon alone will receive more than $10.4 million.
The money is the headline, but the conduct terms will matter more to anyone who builds connected products. GM must now get drivers’ affirmative, express consent before it collects or shares driving and location data. It must also limit what it collects, run a full privacy program, submit to internal and external assessments, and put oversight and training in place at dealerships. Oregon’s office called the terms “significantly stronger than any other resolution reached with GM for this conduct.”
GM, in a statement, said the settlement addresses its discontinued Smart Driver program and “reinforces steps we’ve taken to strengthen our privacy practices.” A settlement is not an admission, and the findings described below are the coalition’s allegations and investigative conclusions as set out by Oregon’s attorney general.
What the states say happened
From 2016 to 2024, GM enrolled millions of drivers in Smart Driver, a feature that tracked how they drove. According to the Oregon Department of Justice announcement, GM pitched it as a safety tool and told drivers it would not share their data with insurers without express consent. The coalition found that GM instead sold the data to brokers under contracts that specified it was for insurance products, and the brokers sold it to insurers, some of whom changed premiums based on it.
The data was detailed. Insurers could see how many times a person drove, when each trip started and ended, how often the driver braked or accelerated hard, and whether they went over the speed limit. GM ended the program after The New York Times reported on the practice in 2024.
The enrollment process is where the case becomes a lesson for every company that sells through partners. Most Smart Driver users were signed up at the dealership through a single process that also enrolled them in OnStar. In many cases, the states allege, dealership employees accepted the terms on customers’ behalf. Sales staff earned bonuses partly based on how many customers they enrolled in connected services, and dealerships were ranked on enrollment numbers.
One more detail stands out. The OnStar app wrongly told more than 370,000 drivers that they were not enrolled in Smart Driver when they were, and GM kept collecting and selling their data. GM later unenrolled them without telling them about the mistake, and their data remained with brokers and insurers.
What GM must do now
The conduct terms, as listed by Oregon, are:
- Get affirmative, express consent before collecting or sharing driving and location data.
- Limit the driving data it collects and protect personal information through a comprehensive data privacy program.
- Undergo internal and external assessments of that program.
- Put oversight and training in place at dealerships so customers are not signed up for data collection without consent.
The dealership term is the one to watch. It makes the manufacturer answerable for how a separate business, the dealer, presents and records consent. That is an uncomfortable but realistic standard: if your sales channel controls the moment of consent, regulators will treat that channel’s failures as yours.
Why Oregon used an old consumer protection law
Oregon brought its case under the Unlawful Trade Practices Act, its long-standing consumer protection statute, not under the Oregon Consumer Privacy Act. Much of GM’s conduct predates the OCPA, which took effect in July 2024. The attorney general’s office made a point of this: the UTPA “remains a powerful tool for addressing privacy harms.” It also noted that the OCPA now bans the sale of Oregon consumers’ precise geolocation data by all covered entities, not just GM.
That pattern is familiar. State enforcers have repeatedly reached back to unfair and deceptive practices laws to police data uses that happened before comprehensive privacy laws existed. Iowa did the same in its own suit, covered in our piece on Iowa’s case against GM. California’s privacy regulator reached a separate $12.75 million resolution, explained in our analysis of the California GM settlement, and private litigation over the same data flows continues, as we noted when GM and LexisNexis were sued.
The coalition
Oregon and Washington Attorney General Nick Brown co-led the case. An executive committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont assisted. They were joined by Alabama, Alaska, Arizona, the District of Columbia, Florida, Hawai’i, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia and Wisconsin.
The breadth is itself a signal. Red and blue states signed on together, and several of them have no comprehensive privacy law of their own. Driving data sold for insurance pricing is an issue on which consumer protection offices across the political spectrum agree.
Lessons for connected product makers
Cars are the obvious audience, but the same structure exists in smart home devices, wearables, fitness apps, and any product whose telemetry has value to a third party. The GM case points to a short list of failure points.
- Consent buried in a bundle. Enrolling someone in data sharing through the same step that activates a core service makes it hard to show the person chose the sharing. Separate the choices.
- Consent given by someone else. If a salesperson, installer or support agent can click “accept” for the customer, assume it will happen, especially if they are paid on enrollment numbers.
- Promises that conflict with contracts. GM told drivers one thing about insurers while, according to the states, its broker contracts said another. Legal and product teams need to read the same documents.
- Interfaces that misstate status. An app telling 370,000 people they were not enrolled when they were is the kind of error that turns a disclosure issue into a deception claim.
- Silent fixes. Quietly unenrolling people without telling them, and leaving their data with recipients, did not reduce exposure. It became part of the complaint.
Where consent records fit
The common thread is proof. A company that wants to show express consent has to record who agreed, to what, when, through which channel, and what they were shown at the time, and it has to carry that choice to every system and partner that receives the data. That is hard when consent is collected at a dealer, in an app, on a website and by phone. Captain Compliance’s Universal Consent is built for this problem: it collects consent, opt-outs and preferences wherever they are made, resolves them into one permission profile and applies them across connected systems. It does not decide whether a given consent is valid under a given law, and it cannot fix a sales process that pressures staff to click through for customers.
Businesses that buy or sell telematics data should also check whether their counterparties are registered and compliant as data brokers. Our comparison of state data broker laws is a starting point, and our broader guide to connected car privacy covers the rest of the vehicle data chain.
Frequently asked questions
Do drivers get money from the settlement?
The Oregon announcement describes the $220 million as a payment to the states, with Oregon receiving more than $10.4 million. It does not describe individual payments to drivers. Check your state attorney general’s announcement for how your state will use its share.
Did GM admit wrongdoing?
The announcement does not say GM admitted the allegations. GM described the settlement as addressing a discontinued program and reinforcing its privacy practices.
Is Smart Driver still running?
No. GM ended Smart Driver in 2024 after press reports about its data sharing.
What does “affirmative, express consent” mean in practice?
It means the driver has to take a clear action to agree, after being told what will be collected and shared. Pre-ticked boxes, bundled terms, or consent given by a dealer employee would not meet that standard.
Does this affect insurers that bought the data?
The settlement is with GM. Insurers and brokers are not parties to it, but their use of the data has been the subject of separate investigations and lawsuits.
GM’s settlement closes one chapter of a story that started with a newspaper investigation and spread to dozens of state offices. The bigger question is what the 36 attorneys general do with the template. They now have a set of consent, minimization and dealer-oversight terms they negotiated once, and every other company selling connected products through a third-party channel can read them.
