GM to Pay $220 Million Over Sale of Driver Data to Brokers and Insurers
General Motors has agreed to pay $220 million to settle claims that it illegally sold driver and location information to data brokers, state attorneys general announced on October 29, 2026.
The settlement resolves a complaint brought by a coalition of 36 US attorneys general. Oregon Attorney General Dan Rayfield and Washington Attorney General Nick Brown co-led the states' case. Connecticut Attorney General William Tong announced the settlement the same day, and Massachusetts Attorney General Andrea Campbell said her state secured $5.7 million under it. Washington's attorney general said the state will receive $12.3 million, and Ohio's attorney general said Ohio will receive $8,076,105.
The allegations center on Smart Driver, GM's program that is now discontinued. Smart Driver is a telematics program, which means sensors and a data connection in the vehicle report how it is driven. According to the states, the program collected data on driving habits, including acceleration, braking, and trip length. The states allege that GM passed this driving data to data brokers, companies that collect, combine and resell personal information. They further allege that insurance companies bought the data and used it to raise premiums. The states also accused GM of failing to tell drivers they were enrolled in the program.
Under the settlement, GM must limit the driving data it collects. It must also obtain "express consent," a clear, affirmative agreement from drivers, before collecting their information. The agreement is an obligation GM has accepted.
The case follows an earlier action in California. In May, Reuters reported that GM agreed to pay $12.75 million to settle similar claims in that state. That settlement includes civil penalties and restricts GM's use of consumer driving data, and it is subject to court approval. The California terms and the national settlement address the same category of conduct, so drivers in multiple states may see changes to how GM enrolls them and handles their data.
For engineers working on connected-vehicle platforms, the practical question is the consent flow. Telematics pipelines are typically built to collect first and classify later, with enrollment handled as a default setting. An express-consent requirement reverses that order. Enrollment has to be an affirmative, documented act by the driver, and the collection scope has to match what the driver agreed to. Limits on collection also mean that data retention and onward sharing need to be scoped to the same boundary. A narrower intake does not help if downstream partners still receive full trip-level records, meaning a log of each individual journey.
The broader context here is the path that the data took after collection. The states' allegations describe a chain that ran from vehicle telemetry to brokers, then to insurers, then to premium decisions. Each hop is a point where a consent notice either travels with the data or gets dropped. The notification allegation, that drivers were never told they had been enrolled, suggests the break happened at the first hop.
In my view, the most useful lesson for product teams is that consent has to be verifiable after the fact, not just displayed at sign-up. A checkbox that cannot be traced to a specific driver, program, and data scope will be hard to defend when a regulator asks for records. Telematics can still provide real value to drivers, including feedback on driving behavior, but that value depends on drivers knowing they are in the program and choosing to be there.
