General Motors agrees to consent rules in $220 million driver-data settlement

Overview

Updated 1 hour ago

For years, drivers who signed up for a free OnStar feature had their braking, speeding, and location data sold to data brokers. On Oct. 29, 2026, General Motors agreed to pay $220 million to 36 states and to get explicit permission before collecting or sharing that data again.

The settlement covers Smart Driver, a program GM ended in 2024. It also imposes a court-enforced privacy program and an independent audit, creating a template for how connected cars handle driver data.

Why it matters

Your car can record where you drive and how you brake; this settlement requires GM to ask before selling that data to insurers.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$220M

Settlement payment to 36 states

Resolves allegations that GM sold driver behavior and location data.

States in the coalition

Attorneys general from 36 states joined the settlement.

10.3M

Drivers whose data was allegedly sold

Connecticut's attorney general said the data sale affected over 10.2 million people.

370,000

Drivers wrongly told they were not enrolled

The OnStar app mistakenly told them they were not in Smart Driver, Connecticut said.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Mary Barra

Chair and chief executive of General Motors

Leading GM's response to the settlement

Letitia James

New York attorney general

Part of the 36-state coalition that settled with GM

William Tong

Connecticut attorney general

Announced settlement terms with Connecticut-specific details

Organizations Involved

General Motors (GM)

Automaker

Settled multistate privacy claims; must comply with consent decree

One of the largest U.S. automakers, now bound by a multistate privacy consent decree over driver data.

OnStar

Connected vehicle service

GM subsidiary; subject to FTC order and settlement terms

GM's connected vehicle and emergency services subsidiary, whose app and onboard systems collect location and driving data.

Federal Trade Commission (FTC)

Federal Agency

Finalized separate order in January 2025

The federal agency that enforces consumer protection and privacy law.

Coalition of State Attorneys General

Multistate law enforcement coalition

Settled with GM over driver data sales

A group of state attorneys general that sued GM over Smart Driver data sales.

Timeline

2024 October 2026

4 events Latest: 3 days ago

Tap a bar to jump to that date

October 2026
36 states announce $220 million settlement
Latest Legal

GM must obtain express consent before collecting or sharing driver data.
3 days ago
Consent decree requires independent privacy audit
Legal

Third-party assessor must review GM's privacy program within 90 days.
3 days ago
January 2025
FTC finalizes data-sharing order
Regulation

Commission bans GM and OnStar from sharing certain consumer data.
January 16th, 2025
2024
GM ends Smart Driver
Product change

Automaker discontinues the connected-car feature after reporting on data sales.
2024

Scenarios

Independent audit finds GM's privacy program compliant

Likely Resolves by Q2 2027

Discussed by: Washington Attorney General and the consent decree

The consent decree requires GM to hire a third-party assessor within 90 days of the effective date. The assessor reviews whether GM has implemented the required privacy controls and files findings with the court. A clean report would let GM close this chapter without further penalties.

A participating state sues GM for violating the consent decree

Possible Resolves by Oct 29, 2028

Discussed by: Consent decree compliance terms

The settlement imposes detailed consent, disclosure, and data-limitation requirements. If a state finds GM collecting or sharing driver data without the required separate consent, it could return to court to enforce the decree. That would test whether the new rules have teeth.

GM settles pending private class action with driver payments

Possible Resolves by End of 2028

Discussed by: Michigan Attorney General

Michigan's attorney general said the state settlement does not provide consumer restitution and that a nationwide private class-action lawsuit seeking monetary relief remains pending. A settlement in that case would put cash in drivers' hands and could set a separate compensation benchmark.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

March 2018

Facebook–Cambridge Analytica (2018)

A whistleblower revealed that a third-party app had harvested data from millions of Facebook users and passed it to Cambridge Analytica, a political consulting firm. Facebook said the data was taken without users' meaningful consent.

Then

Facebook apologized, changed app permissions, and faced congressional hearings.

Now

The Federal Trade Commission later imposed a $5 billion fine and a consent order requiring privacy oversight.

Why this matters now

Shows how data collected for one purpose can travel to third parties, and how consent decrees change corporate practices.

September 2015

Volkswagen diesel emissions settlement (2015)

U.S. regulators accused Volkswagen of installing software that made diesel cars pass emissions tests while polluting more on the road. The company admitted the defeat devices.

Then

Volkswagen agreed to a multibillion-dollar settlement with owners, states, and federal regulators.

Now

It became a template for multistate auto enforcement and court-monitored compliance.

Why this matters now

GM's settlement follows a similar structure: a state coalition, a large payment, and a consent decree with outside review.