GM to pay $220 million over selling drivers' data

The agreement was announced on Thursday. It settles a lawsuit brought by a coalition of attorneys general from 36 states, TechCrunch reports. Ars Technica describes the group as the District of Columbia plus 35 states.

An attorney general is a state's top lawyer. The states alleged that GM sold private driving behavior and location information to data brokers. Data brokers are companies that buy and resell personal information. They in turn sold it to insurance providers.

In real life Think of a driving diary that lists where you went and how hard you braked. The claim is that copies of it ended up with companies that set insurance prices.

Smart Driver was a free feature inside GM's connected car apps. It tracked and rated driving habits and seat belt use. Ars Technica says GM marketed it as a way for parents to watch teen drivers or for adults to track their own driving.

The data was gathered through GM and its OnStar service. OnStar is GM's 30-year-old safety and roadside assistance service.

GM says the agreement "addresses Smart Driver, a product we ended in 2024." It also says the deal "reinforces steps we've taken to strengthen our privacy practices."

It began with a New York Times report more than two years ago. TechCrunch says the report showed how GM and OnStar collected, used and sold drivers' precise location data and driving behavior to third parties.

Those third parties included the data brokers LexisNexis and Verisk. The brokers sold the information to insurance companies, which could affect customers' rates, according to the Times as summarized by TechCrunch.

Ars Technica adds that some drivers found their insurance became more expensive. It also says many of them claimed they never knew they had agreed to share such data.

The terms are in line with deals GM already reached with California and the Federal Trade Commission (FTC), TechCrunch says. The FTC is the US agency that polices unfair business practices.

• Express consent: GM must get drivers' clear, explicit permission before it collects or shares their driving and location data.
• Third-party check: an outside party must assess whether GM follows the privacy program it has set up.
• No linked sales: GM says it will no longer sell vehicle data that can be linked to a person, a vehicle's location or how someone drives.

The catch: TechCrunch notes GM may still disclose anonymized data, meaning data not tied to one person, with certain partners.

GM has also updated its privacy policy and created a consumer-facing Privacy Center, a page where customers can see and manage their choices.

The outside review is the new part. TechCrunch says earlier agreements did not include it.

This is the third big public step in the story. Here is the timeline from the sources we read:

• 2024: GM ends Smart Driver, according to GM's statement and Ars Technica.
• January 2025: GM and OnStar agree to an FTC settlement, Insurance Journal reports.
• January 2026: the FTC finalizes its order. It bans sharing geolocation or driver behavior data with consumer reporting agencies for five years.
• May 2026: CalMatters reports GM agreed to pay $12.75 million in civil penalties to California, the largest ever under the California Consumer Privacy Act. California officials said GM made about $20 million from selling data between 2020 and 2024.
• October 29, 2026: the $220 million multistate deal.

California settled first, and its case gives the most detail. Insurance Journal, running Reuters reporting, says GM agreed in May to pay $12.75 million to resolve an investigation by California Attorney General Rob Bonta. The deal was subject to court approval.

The state said GM sold two data brokers detailed driving data on hundreds of thousands of Californians. The data included names, phone numbers and home addresses. It also showed the GPS location of where OnStar subscribers drove and parked.

• Driving habits: from 2016 through 2024 GM also tracked speeds and sudden acceleration, the state said.
• The money: California said GM reportedly made about $20 million nationwide from these data sales.
• The ban: the deal bars GM from selling that data to brokers and includes a five-year ban on sales of personal data.

The catch: Bonta said California drivers did not see rate hikes from GM's data sales. State insurance law bars insurers there from using driving data to set rates. Media reports said insurers elsewhere used such data to raise prices.

Bonta also said GM sold the data "despite numerous statements reassuring drivers that it would not do so." That is the state's allegation, and GM said its deal addresses Smart Driver and strengthens its privacy practices.

The FTC is the federal watchdog in this story. Insurance Journal reports the agency said GM's behavior was an "egregious betrayal of consumers' trust."

In January 2025 the FTC said GM and OnStar agreed not to disclose or sell sensitive geolocation and driver behavior data to consumer reporting agencies for five years. A consumer reporting agency is a company that compiles records used to judge people, such as for credit or insurance.

The final order came in January 2026. Repairer Driven News says it lasts 20 years. For that whole time, GM must:

• Ask first: get clear consent before collecting, using or sharing connected vehicle data, with exceptions such as sending location to emergency responders.
• Show and delete: let US consumers request a copy of their data and ask for deletion.
• Switch off location: let drivers turn off precise location collection where the vehicle can do it.
• Opt out: offer a way to opt out of location and driver behavior collection, with limited exceptions.

Possibly. Earlier this year, Repairer Driven News reported that Iowa's attorney general had filed its own lawsuit. It claimed GM collected and sold data from 186,000 Iowa vehicles.

The same outlet said attorneys general in Arkansas, Nebraska and Texas had also sued GM. A Florida consumer had sued too. The articles we read do not say how those cases stand after this settlement.

These were claims in lawsuits. They are not findings by a court.

Cars now carry cameras, sensors and powerful computers. TechCrunch says automakers are betting big on software-centered vehicles that connect to your calendar, messages and email.

GM itself is adding a personal AI assistant to OnStar. TechCrunch reports that cameras on the vehicle will connect to the software to offer live views and crash and safety recordings. You will also be able to use your voice to control things like the climate settings.

GM said at its GM Forward event in October that customers decide what data is shared. It said recordings have time limits and are encrypted, and that neither GM nor OnStar can access Connected Camera recordings.

Customers who choose not to share data will likely get fewer features, GM says.

• Expect a clear question: GM must ask for your express consent before collecting or sharing driving and location data.
• Check your settings: look for GM's Privacy Center and review what your car's apps are allowed to collect.
• Know the trade-off: GM says opting out of sharing will likely limit some features.
• Watch for the review: the outside check is meant to confirm GM follows its own rules.