General Motors has agreed to pay $220 million to settle allegations that it shared drivers’ personal location and driving-behavior data with third parties without obtaining proper consent.
Announced on October 29, 2026, the multistate agreement involves a coalition of 36 attorneys general and concerns GM’s OnStar Smart Driver program, which operated from 2016 to 2024.
The information reportedly reached data brokers and insurance companies, where it could be used to influence premiums. The settlement is significant for more than its financial penalty.
It raises questions about what modern vehicles collect, how automakers use connected-car services, and whether drivers truly understand the privacy terms they accept when buying a vehicle.
How GM’s Smart Driver Program Collected and Shared Driver Data
GM promoted Smart Driver as a connected-car feature intended to help motorists understand and improve their driving habits.
Available through OnStar services and GM’s connected-vehicle ecosystem, the program monitored driving behavior and provided feedback about activities such as hard braking, rapid acceleration, and other driving patterns.
The feature was promoted as a tool for encouraging safer driving. However, state investigators alleged that the collected information was also shared with companies involved in insurance products, a practice many customers may not have fully understood.
According to the coalition of attorneys general, GM enrolled millions of drivers in Smart Driver between 2016 and 2024. The company allegedly shared identifiable driving and location information with data brokers, including information that could be used by insurance companies when evaluating customers and setting premiums.
The data included how frequently a person drove, the start and end times of trips, hard braking and acceleration events, and instances of driving above designated speed thresholds.
The concern was not simply that vehicles collected information. Connected cars routinely generate data needed for navigation, diagnostics, safety features, and remote services.
The central allegation was that drivers were not adequately informed that their personal driving records could be passed to data brokers for insurance-related use. State officials also said GM had told customers that their information would not be shared with insurers without express permission.
The enrollment process was another major issue. Investigators alleged that many customers were signed up at dealerships while purchasing vehicles or enrolling in OnStar.
In some cases, dealership employees allegedly accepted terms and conditions on customers’ behalf without obtaining their actual consent. State officials said GM had incentivized dealerships to increase connected-service enrollments, creating pressure to sign up customers.
A particularly troubling finding involved the OnStar app. According to Michigan’s attorney general, the app incorrectly informed more than 370,000 drivers that they were not enrolled in Smart Driver even though their information was being collected and shared.
GM later unenrolled those customers without informing them of the mistake, while their previously collected information allegedly remained with data brokers and insurance companies.
The program was discontinued in 2024 after reporting brought attention to GM’s data-sharing practices. The settlement now resolves allegations brought by 36 attorneys general, including the District of Columbia.
It does not mean every individual driver experienced an insurance increase, but it confirms that regulators considered the collection and sharing practices serious enough to require a substantial nationwide resolution.
What the $220 Million Settlement Requires GM to Change
The $220 million payment will be distributed among the participating states, rather than paid directly to affected vehicle owners. Michigan, for example, is set to receive approximately $7.2 million, while other states will receive amounts based on the agreement.
This distinction matters to consumers. The settlement is a public enforcement action, not a nationwide compensation program. Michigan’s attorney general has clearly stated that the agreement does not include payments or refunds for affected consumers. Meanwhile, a separate private class-action lawsuit seeking financial compensation is still pending.
The most important requirement is that GM must obtain affirmative, express consent before collecting or disclosing covered driving and location data. In practical terms, a customer must be given a clear explanation of what information is being collected and how it will be used, followed by an active decision to agree.
Simply accepting broad general terms and conditions, remaining inactive or encountering a preselected consent option does not meet the standard described in the settlement.
GM must also limit the driver information it collects and establish a comprehensive privacy program. The agreement includes internal and external assessments of its data-protection practices, oversight requirements, and training for dealership personnel.
These provisions are intended to prevent customers from being enrolled in data-collection services without their knowledge and to improve the company’s accountability for how connected-car information is handled.
The multistate settlement follows earlier federal action. In January 2025, the Federal Trade Commission finalized a separate order involving GM and OnStar over allegations that they collected and sold precise location and driving-behavior data without adequately informing consumers.
That order prohibits GM from sharing certain information with consumer reporting agencies for five years and imposes privacy requirements for 20 years. It also requires a process through which U.S. consumers can request copies of their data, seek deletion and, where vehicle technology permits, disable precise location collection.
These are separate legal actions, not two payments that should be combined into one settlement figure. The FTC order established federal restrictions, while the October 2026 agreement resolves claims brought by state attorneys general and adds further requirements.
Together, they demonstrate that connected-vehicle privacy is becoming a significant area of regulatory scrutiny.
What Car Owners Should Check Before Sharing Vehicle Data
The GM case offers a lesson that applies beyond one automaker. Modern vehicles can collect far more information than drivers might expect.
Depending on the model and connected services enabled, that information may include location history, trip duration, vehicle diagnostics, driving events, infotainment activity, and data linked to a vehicle identification number. Some information is necessary for services to function, but other collection and sharing may be optional.
Owners should review the connected-services settings and privacy notices for their specific vehicle. GM customers can check their OnStar and vehicle-account settings to understand which services are active and what data permissions they have granted.
Drivers should pay particular attention to features described as driving scores, usage-based insurance, driver coaching, or safety monitoring. These services can involve collecting detailed behavior information, so it is worth checking whether data is shared with outside companies.
It is also sensible to ask dealerships direct questions before agreeing to connected services. Customers should not assume that signing up for roadside assistance, emergency response, or a trial subscription automatically means they have agreed to every optional data-sharing feature.
Ask which permissions are required, which are optional, and whether the information can be provided to insurers or data brokers.
One important caveat remains. Disabling a connected service does not necessarily remove data that was collected before the service was turned off.
Drivers who want to understand what a company already holds should use its privacy-request process to ask for a copy of their information and, where available, request deletion. The FTC’s order specifically requires GM to provide U.S. consumers with ways to make those requests.
The insurance implications also deserve attention. Driving data can reveal patterns that traditional insurance applications may not capture, including frequent late-night trips, hard braking, and speeding events.
Insurers may view such information as useful when assessing risk, but consumers should be able to understand how it is obtained and whether it affects their premiums.
The settlement does not establish that every GM owner paid more for insurance, and drivers should not assume they are automatically entitled to a refund.
Automakers face an equally important lesson. Connected-car technology should not be viewed as blanket permission to collect and sell every piece of available data. Drivers deserve meaningful choices, clear explanations of data practices, and control over information that can reveal their identities and daily travel patterns.
GM’s position also needs to be understood in the context of how the agreement was reached. The settlement resolves the states’ allegations without GM admitting the facts or liability described in the complaint.
The company said the agreement reinforces its efforts to strengthen privacy protections and clarify customer choices. That legal distinction does not erase the regulatory findings or the new obligations, but it means the agreement should not be described as a court finding that GM admitted wrongdoing.
For car owners, the most important takeaway is that vehicle privacy deserves the same attention as other connected-device permissions. A car can record far more than its mileage and maintenance history. Understanding what is collected, who receives it, and whether it can affect insurance decisions is now an essential part of being an informed vehicle owner.
