General Motors has agreed to a multistate settlement over allegations that its connected-car services collected and sold identifiable driving data without adequate consent. Announced on 29 October 2026, the agreement covers 35 US states and the District of Columbia, requires payments equivalent to approximately €196.9 million and sets detailed conditions for how GM obtains permission to process driver information.
The amount is an indicative conversion using the European Central Bank's 30 October reference rate. It is money allocated to the participating authorities. The Oregon agreement does not establish an individual claims scheme through which every affected motorist receives a payment. Its other provisions address enrollment, data access, deletion, dealer conduct and independent scrutiny of GM's privacy controls.
The disputed route from car to insurer
Oregon's complaint says GM introduced Smart Driver within OnStar in 2015, promoting it as a way for customers to assess their own driving and develop safer habits. The state's allegation is that identifiable information also entered a commercial reporting chain, reaching data brokers whose products were used by insurance companies.
The driving records described in the complaint include hard braking, rapid acceleration, hard cornering, crossing a designated speed threshold, seat-belt use and late-night driving, together with trip timing and duration. The complaint separately describes precise location collection through OnStar, linked to identifying information including names, addresses and vehicle identification numbers.
The recipients should not be treated as interchangeable. According to the complaint, GM's arrangement with LexisNexis included precise geolocation, whereas its Verisk contract expressly prohibited GM from supplying that location information. Both companies are described as compiling consumer reports or driver ratings for insurers. The authorities say some insurers used the information in part to set premiums, sometimes increasing them.
That qualification matters. The public documents do not establish that every enrolled customer paid more, nor do they quantify a uniform increase. They describe a disputed data practice and examples of insurance consequences, rather than a calculation of each customer's financial loss.
How enrollment became part of the case
The investigation, co-led by Oregon and Washington, examined what happened at dealerships as well as inside the software. Most Smart Driver registrations occurred during vehicle purchases, through a process that also enrolled customers in OnStar. Authorities allege that dealership employees sometimes accepted terms on customers' behalf without their consent.
GM also encouraged connected-service enrollment through incentives. Sales staff bonuses depended in part on sign-up numbers, and dealers were ranked by enrollment performance, according to Oregon's announcement. The settlement therefore reaches beyond the wording of a privacy notice to the actions taken by sales staff while delivering a vehicle.
Another allegation concerns more than 370,000 drivers. The OnStar app incorrectly showed that they were not enrolled in Smart Driver even though GM was collecting and selling their information, the authorities say. GM subsequently removed them from the program without explaining the error, while previously shared data remained with brokers and insurers, according to the investigation.
A separate affirmative decision
The Oregon text defines consent as a clear, freely given, specific, informed and unambiguous affirmative act. Broad terms of use that mix driving-data processing with unrelated matters do not meet that definition. Silence, inactivity and preselected boxes also fail to qualify.
Separate, unrelated services or features require separate consent. The document includes limited exceptions, such as supplying information to emergency responders and certain safety or legal uses. It is therefore inaccurate to describe the agreement as a complete prohibition on collecting any information from a connected vehicle.
Within 60 days of the specified effective date, GM must implement an enrollment procedure based on independent consumer action, such as responding to an email. Under that procedure, a customer who takes no action within ten days of an enrollment notice is treated as declining OnStar. Periodic checks must look for unusual registration patterns that could indicate dealership noncompliance.
Dealer training must explain that customers need an opportunity to review privacy disclosures and accept them personally. The agreement also requires data minimization, a privacy program, internal assessments and an independent third-party review. These provisions supply mechanisms for examining how consent works in practice, rather than relying entirely on a customer's ability to find a policy online.
Smart Driver ended before this agreement
GM announced on 24 April 2024 that it would discontinue Smart Driver across its vehicles and unenroll customers. The company said it had heard customer feedback and described the program's original purpose as encouraging safer driving. It also stated that data sharing with LexisNexis and Verisk had ended on 20 March 2024.
A separate federal action has already produced restrictions. The Federal Trade Commission finalized its GM and OnStar order on 14 January 2026. It imposes a five-year ban on disclosure of the covered geolocation and driving-behavior information to consumer reporting agencies, with other transparency and choice requirements running for the order's 20-year life.
Those federal requirements include ways for US consumers to request a copy of their information and seek deletion, disable precise location collection where the vehicle supports it, and opt out of certain collection. Exceptions apply, including provision of location information to emergency responders. The federal order and the new multistate agreement should be read as separate instruments with their own scope and deadlines.
Money, court status and retained information
The Oregon document specifies an effective date of 30 November 2026 and payment within 30 days of that date. The publicly posted copy still has a blank judicial signature line. It records agreed terms but does not, by itself, establish that a judge has already entered the judgment. GM does not admit legal violations or liability under the settlement.
For consumers covered by the Oregon text, a simple method must allow requests for their driving data and the categories of third parties receiving it. Requests are to be processed within 45 days. Deletion provisions include exceptions for records that must be retained for legal or other specified obligations. Ending enrollment, accessing an existing record and removing retained information are consequently distinct steps in the agreement.
Photo: General Motors, OnStar press material dated 2 February 2024. Illustrative vehicle interior, not evidence from the investigation.
