GM Will Pay $220 Million to Settle Claims It Sold Driver Data to Insurers

• General Motors will pay $220 million to settle claims from 35 states and the District of Columbia that it sold drivers’ location and driving data to brokers whose customers included insurers.
• The attorneys general say the Smart Driver program tracked millions of drivers from 2016 to 2024, and more than 370,000 were told they were not enrolled when they were.
• The settlement sends the money to the states, not to drivers, but every driver can ask GM, LexisNexis and Verisk for the file each holds and dispute errors.

Did Your Dealership Sign You Up for a Driving Score?

General Motors will pay $220 million to settle allegations that it sold drivers’ behavior and location data to third parties, including data brokers, who passed it to insurance companies. The Washington State Attorney General announced the settlement on Thursday, October 29, 2026. Insurers used the data in part to set rates and sometimes raised premiums. GM settled without admitting the facts or liability alleged in the complaint.

Whether this affects you turns on one date range. Smart Driver ran from 2016 to 2024, when GM discontinued it. A driver who bought a GM vehicle in those years and agreed to the connected services at the dealership counter, or who never knew anyone had agreed on their behalf, is the person the case describes.

The money does not come back to drivers. The consent decree directs the $220 million to the participating states, and it contains no per-driver payment. What drivers receive is a set of rights: to see the data, to ask for deletion and to refuse future collection.

What the 36 Attorneys General Say GM Did

Washington co-led the case with Oregon, and the coalition numbers 36 attorneys general, counting the District of Columbia. Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont sat on the executive committee. Washington’s share is $12,311,819, about 5.6 percent of the total. The decree lets the Washington office spend it on investigation costs, monitoring, enforcement of the state consumer protection act or any lawful purpose of the office.

GM pitched Smart Driver as a tool that helped drivers improve their own driving safety, and told them it would not share their data with insurers without express consent. The investigation found otherwise. GM sold the information to data brokers under contracts that named insurance products as the use. The brokers sold it on to insurers, and an insurer could then change a driver’s premium based on how that driver behaved at the wheel.

The data was personal, identifiable and specific. Insurers could see how many times a person drove, when each drive started and ended, how many times the driver braked or accelerated hard, and whether the driver went faster than the speed limit.

“People bought a car, not a tracking device,” said Oregon Attorney General Dan Rayfield. Washington Attorney General Nick Brown put the same point in terms of control: “Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used.”

GM answered the settlement with a statement from a spokesperson. The company said the settlement reinforces other steps it has taken to strengthen privacy, and that it is committed to being clear about what information is used, how it is protected and the choices customers have about what they share.

How a Dealership Sign-Up Turned Into a Data Feed

Most drivers who enrolled did it where they bought the car. GM used one sign-up process for Smart Driver and for its OnStar services, so signing up for OnStar’s safety service and signing up for the driving score ran through the same step. The attorneys general say dealership employees in many cases accepted the terms and conditions on a customer’s behalf, without the customer’s consent.

The incentives pointed one way. Sales employees received bonuses based in part on how many customers signed up for GM’s connected vehicle services, and GM ranked dealerships by their enrollment numbers.

GM’s own systems made the problem harder to spot. The OnStar app told more than 370,000 drivers they were not enrolled in Smart Driver when they were, and GM kept collecting and selling their data. GM later unenrolled those drivers without telling them about the mistake, and the data stayed with the brokers and the insurers. A driver who opened the app, saw “not enrolled” and moved on had no reason to look further.

Published reporting documented how insurance companies used this information to change rates, sometimes raising premiums. After that reporting, GM discontinued Smart Driver. Insurers such as Allstate, Progressive and Geico use telematics, the term for monitoring driving habits, and say the technology rewards good driving with lower premiums. Progressive’s Snapshot telematics program, for example, adjusts premiums on braking, mileage and time of day. The issue in this case is consent: GM did not tell Smart Driver enrollees their data would be sold for insurance.

What the Settlement Changes

Two earlier actions came first. In January 2026 the Federal Trade Commission finalized its order against GM and OnStar, banning GM for five years from disclosing geolocation and driver behavior data to consumer reporting agencies. The Commission voted 2-0. On May 8, California Attorney General Rob Bonta announced that GM agreed to pay $12.75 million to settle a California investigation into the alleged sale of driver data to two data brokers, LexisNexis Risk Solutions and Verisk.

The state settlement adds specific rules. Washington’s consent decree, one of the similar judgments GM is entering with each state, takes effect on November 30, 2026:

GM must obtain affirmative express consent before it collects or discloses covered driving and location data. If it discloses data to a third party for usage-based insurance, the consent has to say the data can be used for insurance rates or coverage, and that notice cannot sit inside a privacy policy or terms of service.

Enrollment in OnStar has to come through independent action by the customer, such as an email. A customer who does not act within 10 days of that notice counts as declining. Within 60 days of the effective date GM must train dealership staff that the customer reads and accepts the privacy disclosures personally, and GM must sample enrollments to find dealerships with unusual patterns.

GM must ask third parties that received driver data before January 16, 2025 to delete it. GM cannot send data again to a company on that list until the company confirms it received the request, and a consumer reporting agency must also confirm in writing that the data is deleted or that a legal requirement blocks deletion. Within 180 days of the effective date GM must delete or destroy the driver data it kept from before that date, with exceptions that include litigation holds, safety investigations and warranty work. GM has to give consumers an easy way to ask for deletion and to ask for a copy of their data with a list of the categories of companies that received it, and it must answer a copy request within 45 days. Both obligations run until January 13, 2046. After its current litigation hold on the data expires, GM must post a notice of those options on its website for six months and email it to everyone enrolled in OnStar at any time from January 1, 2018 through the effective date.

An independent assessor reviews the privacy program, with the first assessment covering the 365 days after the effective date and further assessments covering each two-year period over the next four years. The Washington attorneys call the terms significantly stronger than any other resolution reached with GM for this conduct. Payment of the $220 million is due within 30 days of the effective date, and the decree is signed without admission of any facts or liability.

The decree releases only the states’ civil claims, and it states that it neither creates nor waives any private right of action.

What to Do Now

Start with the file. The Fair Credit Reporting Act gives you the right to the information a consumer reporting company holds about you. The LexisNexis Risk Solutions auto insurance report, listed by the Consumer Financial Protection Bureau, covers up to seven years of auto claims and also collects driving behavior data for auto pricing. LexisNexis provides one free report every 12 months on request. The CFPB lists the consumer center number as 866-897-8126, and the request form is on the LexisNexis consumer site.

Verisk ran a separate driving behavior report. GM said in 2024 that it ended its partnerships with LexisNexis and Verisk that March, and Verisk said it stopped receiving driving data from GM, Honda and Hyundai and no longer provides those reports to insurers. The request form is still posted, and it states that Verisk has driving data only from vehicles made by General Motors, Hyundai and Honda. That makes it the way to see what Verisk kept from the earlier years. You send a signed form with your name, address history and VIN by mail or fax, and the driving history has to match the name of the owner on the request. The Consumer Inquiry Center number on the form is 800-709-8842.

Read what comes back for trips you do not recognize, hard braking events logged on a day you were not driving and mileage that looks high. If something is wrong, dispute it with both the reporting company and the company that supplied the data. The CFPB notes that reporting companies must investigate a dispute free of charge.

Then go to GM. Request a copy of your data and the list of companies that received it, and ask for deletion. The FTC order already requires GM to create a way for all U.S. consumers to request a copy of their data and seek its deletion, and the decree adds its own request methods that run to January 13, 2046. In your vehicle settings or the GM brand app, check whether connected services and location sharing are on, and switch off what you do not use.

Last, ask your insurer at renewal whether it uses a driving score or outside driving data to rate your policy. The FTC says companies that use consumer reports for insurance must notify you when they take an adverse action based on a report, so ask whether a report played a part in your rate. If your rate rose and you cannot find the reason, compare it with car insurance rates by state to see whether the increase tracks the market or your own file.

Driving data reaches more than insurers. Police databases hold a different kind of record, and several states have moved to limit it; state laws limiting license plate data covers what changed.

The next dates belong to GM. Washington’s decree takes effect on November 30, 2026, payment follows within 30 days, dealership training within 60 days, and the first independent privacy assessment covers the 365 days after the effective date.

Want more car content? Add us as a preferred source on Google to your favourites list for the best automotive news and analysis on the internet.

If you enjoyed this article, be sure to follow us on Microsoft Start.