📅 29 October 2026 • Washington State Attorney General
36 states settle with GM for $220M over sale of drivers' location and behaviour data
General Motors will pay $220 million to settle claims by a coalition of 36 state attorneys general that it sold private driver behaviour and location data to data brokers, who on-sold it to insurers that used it in part to set rates. Washington and Oregon co-led the case. The state shares announced so far include Washington $12.3 million, Oregon more than $10.4 million, Pennsylvania $8.67 million and Delaware $4.7 million.
What the investigation found
Between 2016 and 2024 GM enrolled millions of drivers in its Smart Driver programme and told them it would not share their data with insurers without express consent. The coalition found that GM sold the data to brokers under contracts specifying that it was to be used for insurance products, without telling drivers. The data was personal, identifiable and specific: how often a person drove, trip start and end times, hard braking and acceleration, and speeding. The claims covered nearly 10.3 million drivers.
Most customers signed up at the dealership, where sales employees allegedly accepted terms on their behalf and were partly bonused on connected-service enrolment numbers. The OnStar app wrongly told more than 370,000 drivers they were not enrolled while GM collected and sold their data, and those drivers were later unenrolled without notice while their data stayed with brokers and insurers. GM discontinued Smart Driver in June 2024.
What changes under the settlement
Going forward GM must obtain affirmative express consent before collecting or disclosing driving and location data, limit the data it collects, run a comprehensive data privacy programme with internal and external assessments, and put dealership oversight and training in place so customers are not enrolled without consent. The terms also mandate board-level oversight of the privacy programme, and the agreement resolves the multistate case without a verdict at trial.
IMPACT — compliance takeaways
Telematics, connected-vehicle and insurance-data programmes should treat consent capture at enrolment as a tested control. The settlement targets the exact flows at issue: dealership sign-up and app status messages.
Contracts with data brokers that fix a downstream use such as insurance underwriting are evidence of a purpose mismatch. Map onward transfers and confirm that the purpose told to the consumer matches the purpose contracted with the buyer.
Enrolment records must be reconcilable and visible to the driver, and remediation must reach data already handed to brokers. Expect supervisory focus on internal and external privacy assessments, on dealer training records and on consent evidence. Failure to meet consent, assessment and oversight duties carries enforcement risk under state privacy laws, and the injunctive terms run into the future rather than ending with payment.
Sources: atg.wa.gov press release, reuters.com report, theverge.com coverage, news.delaware.gov release.
Continue the conversation: https://t.me/ComplianceExplained · Bluesky
Top comments (0)