General Motors will pay $220 million to settle claims that it illegally sold drivers’ private driving and location data to third parties, who then sold it to insurance companies.
The settlement, announced on Thursday, October 29, resolves claims by the attorneys general of 35 US states and the District of Columbia. It is one of the largest privacy settlements ever involving a carmaker, and it is a warning to every company that collects data from connected cars.
What Happened
The case centred on GM’s Smart Driver programme, which ran from 2016 to 2024. GM enrolled millions of drivers in the programme, which tracked how they drove: how many trips they took, when each trip started and ended, how often they braked hard or accelerated quickly, and whether they went over the speed limit.
According to the states, GM sold that information to data brokers under contracts that said the data was to be used for insurance products. The brokers then sold it to insurers, who could use it to set premiums — and in some cases, raise them.
The sharpest allegation was about consent. The states said more than 370,000 drivers were told they were not enrolled in Smart Driver when they actually were. Their data was sold anyway, and they were later unenrolled without being told about the error.
GM did not admit wrongdoing in the way these settlements are usually structured, but a GM spokesperson said the agreement “addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.”
Why It Happened
Smart Driver was presented as a tool to help people drive more safely. The problem, according to the states, was what happened next. Drivers were not clearly told their detailed driving records would be sold for insurance use.
The issue first became widely known in 2024, when The New York Times reported on the practice. After that reporting, GM discontinued Smart Driver. But the state investigations continued, and they ended with this $220 million settlement.
The settlement also follows two earlier deals on the same issue. In January 2025, GM agreed with the US Federal Trade Commission not to share vehicle location and driver behaviour data with consumer reporting agencies for five years. In May 2026, GM paid $12.75 million to settle a separate California investigation into selling driver data to two data brokers.
Why It Matters
Your car now collects far more data than most people realise. Modern cars track location, speed, braking and even driving times. That data is valuable — insurers want it because it helps them guess who is a risky driver, and data brokers are happy to buy and sell it.
This settlement sets a clear rule: a company cannot collect that kind of personal data and sell it on without clear, affirmative consent. “Affirmative express consent” means the driver must actively agree, not just fail to opt out of a buried setting.
For drivers, the practical point is simple. If a car app or feature asks to track your driving, check what it does with the data and who it shares it with. A feature described as a safety tool may also be a data product.
What Happens Next
Under the settlement, GM must limit the driving data it collects, get drivers’ express consent before collecting or sharing driving and location data, and run a comprehensive data privacy programme with internal and outside assessments. It must also train and oversee dealerships so drivers are not signed up without agreeing.
The money goes to the states, not directly to individual drivers. Arizona, for example, will receive $5.9 million, Pennsylvania nearly $9 million, and Colorado about $7.2 million. Drivers who believe their premiums rose because of Smart Driver data should not expect a cheque from this deal — the settlement names no individual payments.
Other carmakers will be watching closely. If they run similar connected-car programmes, they now have a very expensive example of what happens when consent is unclear.
Final Thoughts
Cars used to be machines you owned. Now they are also computers that watch how you drive. That can be useful — for safety features, for maintenance, for finding your car. But the GM case shows the other side: once your driving record leaves the car, you lose control of who sees it and what they do with it. The $220 million price tag is GM’s bill for forgetting that drivers, not data brokers, should decide.
Key figures:
- Settlement: $220 million, announced October 29, 2026
- Claimants: attorneys general of 35 states and the District of Columbia
- Programme: Smart Driver, 2016 to 2024, millions of drivers enrolled
- Drivers wrongly told they were not enrolled: more than 370,000
- Earlier deals: FTC agreement (January 2025, five-year sharing ban); California settlement (May 2026, $12.75 million)
- State shares (examples): Pennsylvania nearly $9 million, Colorado about $7.2 million, Arizona $5.9 million
Disclaimer: This article is for educational and informational purposes only and does not constitute financial advice.
Sources: CNBC business coverage of the GM settlement (October 31, 2026 edition); Reuters report on the settlement (via https://northlandnewsradio.com/2026/10/29/gm-to-pay-220-million-to-settle-allegations-it-violated-consumers-privacy/); Arizona Attorney General announcement (https://www.azag.gov/press-release/attorney-general-mayes-announces-settlement-gm-company-pay-220-million-sharing)
Related: Cheaper Cars Are Selling Much Faster — But They Are Getting Harder to Find
