GM Settles for $220M Over Unauthorized Sale of Driver Data
GM agreed to a $220 million settlement over claims of selling drivers' private data without consent.
Why it matters: Data privacy breaches in connected vehicles pose serious legal and reputational risks for corporations. The GM settlement signals heightened accountability for mishandling sensitive consumer information.
- GM's $220 million settlement announced Oct 29 involves 36 states addressing misuse of driver data.
- From 2016-2024, GM sold Smart Driver program data on driving habits to data brokers, insurance companies.
- Over 370,000 drivers were misled about enrollment status; their data was sold despite no clear consent.
- Settlement mandates GM get express consent before collecting or sharing location and driving data.
General Motors has agreed to pay $220 million to settle allegations that it illegally sold driving behavior and location data collected from consumers participating in its Smart Driver program. The program, active from 2016 through 2024, tracked millions of drivers’ habits under the promise of improving safety but resulted in data being sold to brokers who forwarded it to insurance firms. This raised concerns about improper use of sensitive data affecting consumers' insurance rates.
The settlement, announced on October 29, 2026, involves a coalition of 36 state attorneys general, including officials from Michigan, Arizona, New York, and Oregon. Michigan will receive over $7.2 million, New York more than $12 million, and Oregon over $10.4 million from the settlement funds. More than 370,000 drivers were mistakenly told via the OnStar app that they were not enrolled in the program, yet their data was collected and sold. GM later unenrolled them silently, without disclosure.
Attorney General Kris Mayes of Arizona emphasized, "Drivers were enrolled in data tracking without their knowledge." Michigan’s AG Dana Nessel noted, "Drivers deserve to know what information about them is being collected and how it may affect their wallets." New York’s AG Letitia James added, "New Yorkers should never have to worry about a car company tracking their every move when they get behind the wheel." Oregon AG Dan Rayfield said, "People bought a car, not a tracking device."
The settlement requires GM to obtain affirmative, express consent from consumers before collecting or disclosing driving and location data. It also mandates a limit on how much data GM can collect from consumers and calls for a robust data privacy program to protect sensitive information moving forward.
By the numbers:
- $220 million — total settlement amount
- 36 states — attorneys general involved in the settlement
- 370,000+ drivers — misinformed about Smart Driver enrollment status
- $12 million+ — funds allocated to New York state
- $10.4 million+ — funds allocated to Oregon state