General Motors will pay $220 million to settle allegations from a 36-state coalition that it sold drivers' private driving and location data to data brokers without permission — and the most damaging findings in the case are not about the selling. They are about how drivers ended up in the program at all.
The case concerns Smart Driver, a GM feature that tracked acceleration, hard braking, speeding, and trip timing and frequency for millions of vehicle owners between 2016 and 2024. GM pitched it as a safety tool and promised not to share data with insurers without express consent, according to state investigators. The data went to brokers anyway, who passed it to insurers, who used it to adjust premiums.
Enrolled at the dealership, on someone else's signature
Most customers were signed up at dealerships through a single OnStar sign-up flow. State investigators found that corporate enrollment targets tied sales bonuses to connected-vehicle sign-ups, and that dealership employees frequently accepted the terms and conditions on buyers' behalf without their knowledge.
Then there is the app. GM's OnStar mobile application told more than 370,000 drivers they were not enrolled in Smart Driver while the company continued to collect and sell their data, according to the investigation. GM later quietly unenrolled those drivers without telling them about the error — leaving the data already collected in the hands of brokers and insurers.
Oregon Attorney General Dan Rayfield, who co-led the coalition with Washington's Nick Brown, put the case in one line: "People bought a car, not a tracking device." He added that GM "told drivers this program would help them drive more safely and promised it wouldn't share their data with insurers without permission. Our investigation found GM sold that data anyway, and some drivers paid for it with higher premiums."
The terms
Beyond the money, GM must obtain affirmative, express consent before collecting or sharing driver data, limit what it collects, stand up a comprehensive privacy program, submit to internal and external privacy assessments, and add dealership oversight and training to stop unauthorised sign-ups.
Oregon received more than $10.4 million. The executive committee behind the investigation included Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont, alongside 24 other states and the District of Columbia.
One procedural detail is worth keeping: Oregon brought its action under the state's Unlawful Trade Practices Act rather than its consumer privacy law, because much of the conduct predates the Oregon Consumer Privacy Act, which took effect in July 2024. The older statute was the one that reached the behaviour.
Not the first bill
The settlement lands after a $12.75 million California settlement earlier this year, and after the FTC's 2025 action, which banned GM for five years from disclosing driver data to consumer reporting agencies. GM ended Smart Driver after reporting by The New York Times showed how insurers were using the data.
The pattern across those actions is the interesting part. The FTC took the collection mechanism. California took a number. Thirty-six states took the enrollment machinery — the quotas, the signatures taken by someone else, the app that said "you're not enrolled" while the meter ran — and made consent something GM has to prove rather than assert.
What to watch
Whether the dealership oversight provisions have teeth: the settlement requires training and monitoring, but the incentive structure that produced the sign-ups — bonuses tied to enrollment — is a management problem, not a compliance form. And whether other automakers, several of which run similar connected-vehicle data programs, read this as the price of the same behaviour.
