On October 29, 2026, a coalition of state attorneys general announced that General Motors will pay $220 million to settle allegations that it sold drivers' behavior and location data to third parties, including data brokers who then sold it to insurance companies. Arizona's attorney general said the data was used by insurers in part to set rates for many consumers. This is a settlement of allegations: according to VTDigger's report on the Vermont announcement, the agreement expressly states that GM does not admit to having broken any law, and it was reached before the coalition formally filed a lawsuit.
Source: Arizona Attorney General's Office press release, captured October 31, 2026.
What the attorneys general say happened
Per the Arizona release, GM enrolled millions of drivers in its Smart Driver program from 2016 to 2024. GM pitched the tool as a way to improve driving safety and told drivers it would not share their data with insurers without express consent. The coalition alleges GM instead sold the data to data brokers under contracts that specified insurance use, and that GM did not tell drivers their data would be sold for that purpose.
The enrollment process is where the allegations get specific. Most customers signed up at the dealership, where one sign-up covered both Smart Driver and OnStar services, and the release says dealership employees in many cases allegedly accepted terms and conditions on behalf of customers without their consent. It adds that GM was heavily incentivizing dealerships to sign up customers for OnStar, with sales employees receiving bonuses based in part on enrollment numbers.
The Arizona release also says GM's own systems failed drivers. The OnStar app mistakenly told over 370,000 drivers that they were not enrolled in Smart Driver when they actually were, and GM later quietly unenrolled them without telling them about the mistake, leaving their data with the brokers and insurers. The data was specific: trip counts, start and end times, hard braking and acceleration events, and speeding.
The deal and who is in it
Vermont Attorney General Charity Clark described a joint effort between 35 states and the District of Columbia that began after a New York Times report on the practice. Arizona's release names Washington and Oregon as co-leads. Arizona receives $5.9 million and Vermont $4.5 million.
Figure: Arizona and Vermont payouts in the $220 million settlement, in millions of dollars, as stated by each state.
On conduct, the Arizona release says the settlement requires GM to obtain affirmative express consent from consumers before collecting or disclosing driving and location data. It also requires GM to limit the driving data it collects, run a comprehensive data privacy program with internal and external assessments, and follow oversight and training requirements at dealerships. GM told VTDigger it discontinued Smart Driver in 2024. We could not open the settlement document itself, so we have not verified its duration or other terms beyond what these two sources describe.
What this means for your site or app
You probably do not sell cars, but the pattern applies to anything that collects location, device, or behavioral data. Three lessons stand out from the allegations.
First, consent has to belong to the person it is about. A terms checkbox accepted by someone else, or buried inside a bundled sign-up, is the exact fact pattern regulators are describing here. If your app collects precise location or usage telemetry, ask for it separately, at the moment of collection, and let people decline without losing unrelated features.
Second, say who actually receives the data. The core allegation is a gap between what drivers were told and where the data went. If you pass data to a broker, ad network, or analytics partner that can resell it, your privacy policy should name that category and the purpose, including insurance or credit uses if they apply. Our guide to 2026 data broker fines shows how regulators treat undisclosed resale.
Third, check what people see about their own enrollment. The 370,000 figure came from an app that displayed the wrong status. If people can see what they are enrolled in, make sure the display matches reality and that unenrolling actually stops collection. Some states already restrict this kind of sale outright, as in Virginia's precise location data ban.
This is also part of a larger enforcement pattern. See how it compares in our ranking of CCPA settlements by size, which already lists California's earlier GM settlement, and our tally of state attorney general privacy actions in 2026. VTDigger also notes the FTC issued an order in January restricting GM's data sharing and that a customer class action is ongoing.
If your policy still describes data sharing in one vague sentence, our Privacy Policy Generator can help you spell out the categories of data you collect, who receives it, and the consent you rely on.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
