$220 million — a sum Washington state called the price of a multistate deal resolving allegations that General Motors collected precise driving data and sold it through brokers to insurers without drivers' informed consent.
The $220 million settlement with 36 attorneys general
The Washington state attorney general's office announced on Thursday that General Motors reached a $220 million settlement with 36 attorneys general and the District of Columbia over the automaker's collection and sharing of driving data. That payment, to be distributed among the participating jurisdictions, equates to less than 7 percent of GM's $3.3 billion in net income attributable to stockholders for its third quarter, which ended on September 30, 2026, the announcement noted. The Washington AG's office described the settlement as “significantly stronger than any other resolution reached with GM for this conduct.”
Allegations: Smart Driver, OnStar, and undisclosed sharing
Investigators said the dispute centers on data gathered through GM’s Smart Driver program, an OnStar offering that collected precise location, speed, seatbelt use and other driving metrics. Smart Driver reports were presented to vehicle owners as tools to inform better driving habits, but a 2024 New York Times investigation found GM had been selling the underlying data to brokers. Those brokers then supplied it to insurance companies that could use the information to set customers' premiums, according to investigators.
States allege the sharing occurred despite GM telling customers it would not provide the data to insurers without express consent. The Washington AG's office said GM also incentivized dealerships to enroll customers in Smart Driver, and that in some cases employees accepted terms and conditions on customers' behalf without their knowledge or consent. Investigators further reported that GM’s OnStar app incorrectly told more than 370,000 drivers they were not enrolled in Smart Driver, even as the company continued collecting and selling their data. The AG’s office summarized the core harm plainly: “The data GM sold was personal, identifiable, and specific.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRegulatory parallel: the FTC order, California settlement, and Texas litigation
GM finalized a separate settlement of the same allegations with the Federal Trade Commission in January 2026. The FTC order requires GM to obtain drivers' express consent before collecting, using, or sharing covered driving data, subject to certain exceptions. The order also obliges the company to offer a simple mechanism for drivers to request a copy of their data, request its deletion, and disable precise geolocation data collection where vehicles support that capability.
California reached its own resolution in May, agreeing to a $12.75 million settlement with GM. A separate case in Texas is ongoing, the Washington AG's office noted, meaning parallel state actions remain unresolved in at least one jurisdiction.
GM's commitments and the end of Smart Driver
Alongside the monetary settlement, GM agreed with the 36 attorneys general to limit the driving data it collects, take steps to better protect customer personally identifiable information, and establish a “comprehensive data privacy program.” The automaker discontinued the Smart Driver program in April 2024, just over a month after the New York Times exposé, citing customer feedback.
A GM spokesperson told The Register that the agreement “reinforces steps we’ve taken to strengthen our privacy practices,” while also defending the continued use of connected-vehicle data. “Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” the spokesperson added.
What this means for insurers, drivers, and dealerships
- Insurers: The states’ allegations describe insurers obtaining driving records indirectly — by purchasing data from brokers that had deals with GM — and using that information to set premiums. The regulatory and legal outcomes require clearer consent steps before such data can flow to insurance companies.
- Drivers: More than 370,000 people were reportedly misinformed by the OnStar app about enrollment status; under the FTC order and the multistate settlement, drivers now have a formal route to obtain copies of their data, request deletion, and turn off precise geolocation where supported.
- Dealerships: The settlements call out incentives that encouraged enrollment in Smart Driver and instances where employees accepted terms on customers' behalf — practices that states flagged as contributing to the lack of informed consent and that regulators will expect to be halted under GM’s new privacy controls.
The settlements close one chapter of a disclosure that began with a 2024 New York Times investigation and produced a federal order and multiple state agreements, but not full legal uniformity: California and the 36 AG coalition reached deals, Texas remains in litigation, and the Washington AG touted its deal as comparatively rigorous. The remedies imposed — monetary payments, limits on data collection, stronger PII protections, and consent requirements — aim to change how connected-vehicle data circulates, even as GM maintains a position that such data can enable safer, personalized experiences. How effectively those programmatic changes prevent future undisclosed sharing will be tested in the months and years ahead.
