GM to Pay $220 Million After 36 States Say It Sold Drivers' Data to Insurers

General Motors has agreed to pay $220 million to settle claims brought by a coalition of 36 state attorneys general that the automaker sold customers' driving and location data to data brokers, who in turn sold it to insurance companies. The settlement, announced Thursday and co-led by Washington and Oregon, is the largest privacy enforcement action yet over GM's "Smart Driver" program, a connected-car feature the company marketed as a way to help drivers improve their safety.

According to the coalition's findings, insurers used the data — trip counts, start and end times, hard-braking and rapid-acceleration events, and speeding — to help set some customers' premiums, in several cases raising them. GM had told enrollees it would not share their information with insurers without their express consent.

What the states allege

The Washington Attorney General's office, which co-led the multistate investigation with Oregon, said GM enrolled millions of drivers in Smart Driver from 2016 to 2024, largely through a single sign-up process at dealerships that was bundled with OnStar activation. The coalition alleges dealership staff sometimes accepted the program's terms on customers' behalf without their knowledge, and that GM gave sales employees bonuses tied to enrollment numbers while ranking dealerships against one another.

The states also allege that a software error in the OnStar app wrongly told more than 370,000 drivers they were not enrolled in Smart Driver, when in fact they were; GM later unenrolled those drivers without disclosing the mistake, and their previously collected data remained with the brokers and insurers it had already reached. The Connecticut Attorney General's office put the scale of the alleged conduct at more than 10.28 million Americans, including at least 123,143 Connecticut residents.

"GM turned private vehicles into mobile insurance surveillance machines without consumer consent or awareness." — Connecticut Attorney General William Tong

How the settlement is structured

Of the $220 million, Maryland will receive $7.33 million, Washington $12.3 million, and Connecticut more than $6 million, according to each state's own announcement — figures that, taken together with other states' shares described in Maryland's release, illustrate how multistate consumer-protection money gets divided among an Executive Committee of ten states — including Maryland, Colorado, Connecticut, Delaware, Illinois, Kentucky, Minnesota, New Jersey, Utah and Vermont — plus 25 additional states and the District of Columbia that joined the action.

Beyond the payment, GM must now obtain affirmative, express consent before collecting or disclosing driving and location data; limit the data it collects; run a comprehensive privacy program subject to regular internal and external assessments; and overhaul dealership training and oversight so staff cannot enroll customers without their consent. Washington's attorney general, Nick Brown, said in his office's statement that the terms are "significantly stronger than any other resolution reached with GM for this conduct."

Background: a program GM already shut down

GM discontinued Smart Driver in April 2024, after the New York Times first reported on the data sales that March. The practice had already drawn a separate response from Washington: the Federal Trade Commission finalized an order against GM and OnStar on January 14, 2026, with commissioners voting 2-0 to approve it. The FTC's order detailed how granular the data collection was — Smart Driver tracked precise location and driving behavior as often as every three seconds, the agency said, and GM's enrollment process failed to clearly disclose that scope of collection. The order bars the companies for five years from disclosing geolocation and driver-behavior data to consumer reporting agencies, and for its full 20-year term requires affirmative express consent before collecting, using or sharing connected-vehicle data; it also requires GM to delete or destroy previously collected driver data except where it is legally required to retain it for law enforcement purposes. That federal settlement carried no monetary penalty. California separately reached its own $12.75 million settlement with GM in May 2026 over the same underlying conduct, bringing GM's total exposure on Smart Driver, across all the settlements reported so far, above $230 million.

Insurance-telematics arrangements like the one GM ran have become increasingly common across the auto industry, letting insurers price policies based on actual driving behavior rather than broad demographic categories, a practice insurers call usage-based insurance. Consumer advocates have argued the model is only fair to drivers if they clearly understand, and affirmatively agree to, exactly what is being collected and sold about them.

A GM spokesperson, quoted by TechCrunch, said the new agreement "addresses Smart Driver, a product we ended in 2024," and that GM is "committed to being clear about what information is used, how it's protected." The company has said it may still share data that cannot be linked to an individual driver or vehicle.

Who's affected, and what's left unresolved

The settlement covers consumers in the 36 participating states and the District of Columbia; it does not resolve separate, ongoing litigation. Texas Attorney General Ken Paxton's 2024 lawsuit against GM over the same practices continues, with Texas seeking a jury trial, civil penalties of up to $10,000 per violation, and a court order compelling deletion of the data, according to reporting by The Record. Private class-action suits against GM also remain pending in federal court.

For GM, the settlement closes one chapter of a controversy that has now produced a federal consent order, a nine-figure state settlement, and continuing state and private litigation — all tied to a feature the company marketed as protecting drivers rather than monitoring them for profit. For the broader auto industry, which has increasingly built insurance-telematics partnerships into connected-car platforms, the size and terms of the GM settlement are likely to be read as a signal of how aggressively state privacy regulators are now willing to police data practices that, until recently, drew little scrutiny beyond federal enforcement.