GM to pay $220M to 36 states over Smart Driver data sales

General Motors agreed on 29 October to pay $220 million to settle claims by a coalition of 36 state attorneys general that it sold drivers' location and driving-behavior data from its Smart Driver program to data brokers, who in turn fed it to insurers. The deal was co-led by Oregon Attorney General Dan Rayfield and Washington Attorney General Nick Brown. Primary source: Oregon DOJ's announcement.

What GM did

GM enrolled millions of drivers in Smart Driver between 2016 and 2024. The program tracked driving habits — trip counts, trip start and end times, hard braking, acceleration, and speeding. GM sold that data to brokers under contracts stating it would be used for insurance products; the brokers resold it to insurers, who in some cases adjusted premiums based on how people drove. GM had told drivers it would not share their data with insurers without express consent.

The enrollment mechanics are the crux. Most drivers were signed up at the dealership at purchase, through a single sign-up that also covered OnStar; dealership staff allegedly accepted the terms on customers' behalf, and sales bonuses were tied partly to enrollment numbers. The OnStar app then wrongly told more than 370,000 drivers they were not enrolled in Smart Driver — and GM later unenrolled them without disclosing the error.

The settlement

The $220 million is split across the 36 jurisdictions; Oregon's share is more than $10.4 million, and Washington's office cited $12.3 million. GM must now:

1. Obtain affirmative, express consent before collecting or sharing driving and location data.
2. Minimize the driving data it collects.
3. Maintain a comprehensive data-privacy program with internal and external assessments.
4. Provide dealership oversight and training to prevent enrollment without consent.

Why it matters

This is not a one-off. It follows GM's $12.75 million California settlement in May and the FTC's five-year ban on GM collecting and sharing driver data, as The Record reported. Connected-car telemetry as an insurance-pricing feed is now a repeat enforcement target, and the AGs went after a specific dark pattern: consent for telematics bundled into the point-of-sale paperwork for an unrelated service (here, OnStar).

If you build or operate a connected-vehicle or telematics data pipeline:

1. Separate consent for telematics from consent for unrelated services; don't bundle them into one sign-up.
2. Map where behavior and location data flows downstream — brokers and insurers included — and document stated purpose against actual use.
3. Treat "affirmative express consent" as the baseline multiple attorneys general will now enforce, not a stretch goal.