Privacy & Cybersecurity Law Blog

On October 29, 2026, a bipartisan coalition of attorneys general (“AGs”) from 35 states and the District of Columbia announced that General Motors (“GM”) had agreed to pay $220 million to settle claims concerning its collection and sale of driver data through its Smart Driver program. The settlement does not provide restitution to consumers. GM did not admit to any wrongdoing.

Under the agreement, GM must obtain consumers’ affirmative express consent before collecting or disclosing driving behavior information (e.g., hard braking, hard acceleration, seat belt usage, late-night driving, trip duration) or precise geolocation data (collectively, “Driver Data”) and limit its collection of Driving Data to that which is adequate, relevant, and reasonably necessary to fulfill the purposes disclosed to consumers. Additional requirements include implementing a comprehensive privacy program, conducting data protection assessments, and providing dealership training and oversight.

The state AGs’ allegations concern Driver Data associated with nearly 10.3 million drivers enrolled in Smart Driver between 2016 and 2024. The state AGs alleged that GM marketed the Smart Driver program as a means of improving driving safety and told consumers that sharing information with insurers required express consent. The state AGs alleged that GM nevertheless sold Driver Data to third parties for insurance-related uses. Such Driver Data included trip timing and frequency, speeding, sudden acceleration, and hard braking. Connecticut’s Attorney General reported that some drivers experienced premium increases.

The state AGs also raised concerns about enrollment. Most customers joined Smart Driver through a dealership process that included OnStar enrollment; some dealership personnel allegedly accepted terms without consumer authorization. Separately, the state AGs alleged OnStar’s app incorrectly indicated that more than 370,000 consumers were not participating. GM later removed those consumers from the program without advising them of the error, but brokers and insurers retained previously disclosed information.

GM stated that the agreement reinforces its privacy improvements and concerns a program that was discontinued in 2024. It also described the resolution as consistent with earlier agreements with California and the Federal Trade Commission. The FTC resolution included a five-year restriction on providing Driving Data to consumer reporting agencies. Related multidistrict litigation remains pending in the Northern District of Georgia.

The settling jurisdictions include Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Hawaii, Idaho, Illinois, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, and Wisconsin.