The most expensive part of the GM Smart Driver affair is not the money. It is the error message.
According to Michigan's attorney general, the OnStar app told 370,000 drivers they were not enrolled in the program that recorded their driving — when they were. GM later quietly unenrolled those drivers without telling them about the mistake, and, the state alleges, left their data with the data brokers and insurers.
On Thursday, General Motors agreed to pay $220 million to a coalition of 36 attorneys general — 35 states plus the District of Columbia — to settle allegations that it unlawfully sold drivers' private behaviour and location data to third parties. Michigan will receive more than $7.2 million, according to Attorney General Dana Nessel's office.
Smart Driver ran from 2016 to 2024. GM marketed it as a tool for parents watching teen drivers and for adults tracking their own habits. What it collected — braking, acceleration, speed, trips, location — went to data brokers, and the contracts, per the Michigan release, specified that the data was to be used for insurance products. Some drivers then saw their premiums rise.
The route there was rarely a conscious decision. Nessel's office says most customers signed up for the program at the dealership when they bought the car, and that employees accepted the terms on the customers' behalf without their consent. Then came the app telling a slice of them the opposite of their real status.
The practice became public in 2024 through a New York Times investigation showing that OnStar Smart Driver logged location and driving behaviour as often as every three seconds and passed it to LexisNexis and Verisk — firms whose data feeds insurers' risk scoring. In January 2026, a US Federal Trade Commission order became final: a five-year ban on disclosing geolocation or driver-behaviour data to consumer reporting agencies, a requirement to obtain affirmative express consent before collecting or sharing it, and a route for consumers to delete it. GM ended Smart Driver in 2024.
The settlement announced on Thursday goes beyond money. GM must limit the driving data it collects and obtain drivers' express consent before collecting or sharing it. And it contains a provision that is unusual in US settlements of this kind: whether GM is living up to its privacy promises will be decided by an independent third party, not by GM's own account.
GM said the agreement addresses Smart Driver, a product it ended in 2024, and reinforces steps it has already taken. "Safer, more helpful and personalized experiences are enabled by connected vehicle data," the company said, "and GM is committed to being clear about what information is used, how it's protected, and the choices customers have about what they share."
The case is more than a settlement over a discontinued product. It shows where the data from connected cars actually goes: not only into maintenance schedules, but into pricing models. And it shows who is currently enforcing privacy in cars in the United States — not a federal regulator with a general rule, but 36 attorneys general, state by state, years after the data had already moved.
What remains unresolved is what a driver is supposed to do about a car whose manufacturer cannot un-share what it already sent. The settlement governs what GM may collect. It does not govern what is already sitting in an insurer's risk model.
