GM to pay $220 million to 36 attorneys general over alleged OnStar and Smart Driver data sales, no admission

$220 million, 36 attorneys general, and no admission from GM

General Motors has agreed to pay $220,000,000 to settle claims by 36 attorneys general that it sold drivers' location and driving data to data brokers, which sold it on to insurers. The Washington consent decree prints $12,311,819 for Washington and Oregon's judgment prints $10,460,649 for Oregon. That is 5.6 per cent and 4.8 per cent of the total, 10.4 per cent together (derived: 22,772,468 divided by 220,000,000). The other 34 shares are not printed in the two texts read for this briefing. The complaint says GM made "over $20 million nationwide" from selling the data to two brokers, so the payment is about eleven times that figure (derived). That ratio is not a penalty to profit measure: the complaint's number covers broker sales only, and the decree lets the states spend the money on costs and enforcement.

What the figure does not establish matters as much. In the decree GM "do not admit to any violation or liability arising from any state, federal, or local law", and the decree says it cannot be used as evidence that GM broke any law. The money goes to the states, not to drivers. The data brokers and insurers are not parties, and GM is only required to ask them to delete data. In the copies the Washington and Oregon offices published, the judge's signature and date lines are blank, so the texts do not show that a court has entered them.

This briefing reads the Washington complaint and consent decree, Oregon's judgment, and the releases from Washington, Oregon, Connecticut and California, all read from 21:09 UTC on Thursday 29 October 2026. The Record's report of the same day is a secondary source and is used only for what it attributes to GM and to the Texas case. The Federal Trade Commission's own pages could not be read (the four ftc.gov addresses requested, including its robots file, answered 404), so the FTC action is described only as Connecticut's release describes it. GM's interest is plain: it is the defendant and wants the matter closed. The attorneys general's interest is equally plain: they are the enforcers and announced the result. Allegations below are allegations.

What the attorneys general allege, and where their papers differ

Washington's complaint was stamped as filed at 9:00 AM on 29 October 2026, the day of the settlement, and the decree resolves it in the same case (derived from the clerk's stamp and the matching case number). It runs to ten pages and is a pleading, not a finding. The table sets out the allegations the press releases lean on, with the paragraph that makes each one and a note on what it leaves unproven.

Two of the allegations are about OnStar rather than Smart Driver. The location collection and the Wejo and Jacobs licensing in paragraphs 4.13 to 4.18 are pleaded against OnStar data, not the driving score programme. That matters for what GM said on the day. The Record quotes a GM spokesperson saying the "agreement addresses Smart Driver, a product we ended in 2024". The decree's own definition of covered data, set out under Technical details, reaches location data and radio listening data as well as driving behaviour, and it names OnStar by name as a service to be governed.

Zoom

What the consent decree requires, with the dates it sets

The decree takes effect on "November 30, 2026" (the Effective Date) and its privacy programme obligations "shall continue until January 13, 2046", which is 6,984 days or about 19.1 years later (derived). Paragraphs 35, 38, 46 and 51 to 54 expire after ten years instead. Footnote 1 lists the 36 jurisdictions that are "simultaneously entering into similar judgments": by count of that list, 35 states and the District of Columbia (derived). So the result is 36 parallel judgments, not one national order, and the Washington text defines a protected "Consumer" as "a natural person in Washington". Oregon's reads the same with Oregon in its place. Paragraph numbers in this briefing are Washington's; Oregon's judgment numbers some of them one higher.

Several terms deserve a closer look than the headline gives them. The consent standard in paragraph 8 excludes "acceptance of general or broad terms of use", pre ticked boxes, silence and any interface that has the effect of "subverting or impairing user autonomy". The decree defines a safety carve out too: consent is not needed to disclose data to emergency responders, to answer a driver's own request, to comply with legal demands, for recalls and warranty work, or for research and diagnostics provided only de identified data goes to third parties (paragraph 41b). Coarse location, such as a ZIP code or a census block with a radius of at least 1,850 feet (about 564 metres, derived), is outside the definition of location data altogether.

Zoom

Zoom

What the record states, and what it does not

Five labels that do the work of a control

"Fine." The Record's headline calls the $220 million a fine. The decree does not. It is a payment divided among the states, with the Washington text allowing use for costs, monitoring and enforcement. A reader who hears "fine" assumes a deterrent calculated on the harm; the record shows no such calculation.

"36 states." It is 35 states and the District of Columbia, each entering its own judgment, each protecting its own residents. Fifteen other states are not on the list (derived: 51 jurisdictions minus 36). California settled alone on 8 May 2026 for $12.75 million, and The Record says Texas's case is ongoing.

"Smart Driver is over." GM ended the programme in 2024, as the Washington release and the complaint both say. The decree is written around OnStar and "covered driver data", which includes location and radio listening data, and it applies to any successor service with substantially the same functionality (paragraph 21). A product being switched off is not the control; the definition is.

"Consent." The complaint says drivers did click "I accept" on a series of screens, and that the decline path warned of losing crash response. A click was recorded; the attorneys general say it was not consent to selling data to insurers. Paragraph 8 of the decree is therefore the useful text: it lists what does not count as consent, including broad terms of use, pre ticked boxes, silence, and interfaces that subvert choice.

"De identified." Data that is de identified after collection falls outside covered data altogether (paragraph 13b). The decree sets a bar for that word: technical safeguards against re identification, business processes that bar buyers from re identifying, and no attempt by GM to do so. Data tied to a VIN, or to a vehicle's garage address, is never de identified. The word is a control only if someone checks it, and the assessor's report goes to Washington's Attorney General, and the decree does not make it public.

Earlier actions, and what is still open

California's own account adds a useful limit. Its release says the investigation found Californian drivers were not directly hit by higher premiums, "likely because under California's insurance laws" insurers may not use driving data to set rates. The harm the 36 attorneys general describe, a premium that moved, depends on the insurance rules of the driver's state. The decrees do not say which states' drivers paid more. California's payment is 5.8 per cent of the multistate sum (derived: 12.75 divided by 220), and the multistate payment is 17.3 times California's (derived).

Technical details

This is a privacy enforcement matter, so the primaries print no hashes, domains or addresses. They do print the data fields, the consent screen wording and the definitions that decide what the decree covers. Each block below is copied from the document named in its caption, read on 29 October 2026. A privacy or data team can use them as a test list: does our own pipeline emit these fields, and do our own screens meet these definitions?

The location record. The complaint describes what each transmission held. At one record every three seconds, a vehicle that is driven for an hour sends 1,200 records (derived: 3,600 seconds divided by 3). The trip identifier is what turns separate records into a route.

This precise geolocation data consisted of latitude and longitude along with elevation, heading, current speed, a date and timestamp, and a trip identifier that could be used to tie multiple transmissions together to identify the entire route of a specific trip taken by a single vehicle. GM collected precise geolocation data every three seconds from ignition on to ignition off.

What the decree counts as covered data. Paragraph 13 is the scope of the whole decree. Two points: it names radio listening data and a short list of driving events, and it excludes data that is de identified after collection. Data tied to a VIN counts as reasonably linkable.

"Covered Driver Data" means information collected by Defendants that: i. Originates from a Vehicle or a General Motors-branded mobile application ("App"), or derived data (such as data generated algorithmically) from information originating from a Vehicle or App; and ii. Is Location Data or is one of the following events linked or Reasonably Linkable to a Consumer: a) radio listening data regarding specific content, channel, or station; or b) driver behavior information regarding hard braking, hard acceleration, hard cornering, crossing of a designated high-speed threshold, seat belt usage, or late-night driving; and trip time and duration for such events. b. Covered Driver Data excludes data (i) related to build, trim, make, model, and year of the Vehicle or (ii) that is Deidentified post-collection.

What does not count as location. The decree draws a line at coarse location, and at data kept only briefly to produce it. A system that stores a ZIP code level position is outside the definition; one that stores a point is inside.

Data that (1) reveals only a Vehicle's, mobile device's, or a Consumer's coarse location (e.g., ZIP code or census block location with a radius of at least 1,850 feet), or (2) that is used solely for the purpose of generating such coarse location and then Deleted within 48 hours of collection is not "Location Data."

The consent standard. Paragraph 8 is the sentence a product team can test a consent screen against. Each of the four exclusions describes a common design.

The following do not constitute Affirmative Express Consent: a. Inferring consent from the hovering over, muting, pausing, or closing of a given piece of content by the Consumer; b. Acceptance of general or broad terms of use or a similar document that contains descriptions of Covered Driver Data processing along with other, unrelated information; c. Obtaining consent through a user interface that has the effect of subverting or impairing user autonomy, decision-making, or choice; or d. Silence, inactivity or inaction, pre-ticked boxes, and other negative option opt-out constructions that require intervention from the Consumer to prevent agreement.

The words on the screens. The complaint quotes the privacy statement drivers were shown first. Its only mention of insurance is a promise of further consent. This is the text the attorneys general say was contradicted by the sales.

With business partners, such as SiriusXM, in connection with their products and services; research institutes, for research and development purposes (for example, improving highway safety); dealers, fleet or rental companies, for service maintenance of your vehicle. We may also share data with third parties for marketing activities (with necessary consents) or where you have elected to receive a service from them and/or authorized them to request data from GM (for example, financial organizations who offer financing for the purchase or lease of GM vehicles or usage based insurance providers)

will result in deactivation of all services, including Automatic Crash Response, Emergency Services, and Vehicle Diagnostics

The enrolment rule that replaces the dealership click. Paragraph 48 turns enrolment into something the driver does later and alone, with silence meaning no. A team can test this as a state machine: no action within ten days must land in the declined state, and covered data collected before enrolment is limited to the purposes in paragraph 41b.

Within sixty (60) days of the Effective Date, Defendants must implement and maintain a policy and procedure for Consumers to enroll in OnStar by independent Consumer action, such as via email ("Enrollment Notice"). Such policy and procedure must include that any Consumer who does not act within ten (10) days of the Enrollment Notice will be treated as declining enrollment in OnStar as set out in Paragraph 47 of this Judgment.

What to do, for drivers and for the companies that hold the data

The decree binds GM and, in the texts read, only GM, so a driver of another make is not covered by it. The first list is for any driver of a connected car. The second is for any organisation that collects or buys vehicle or device data. Items that go beyond what the primaries print are marked as general advice.

The question the settlement leaves open

The decree gives GM a clear list of things to change and almost nothing on the data that has already left. GM must ask its buyers to delete and must hold off new sales until they confirm receipt of the request. It does not say that any buyer, or any insurer that bought a driver rating, must stop using what it has already built from the data, or must change a premium that rested on it. Connecticut says several class actions remain, and Texas's case continues, so those may reach further. The decree itself leaves private rights alone.

For any organisation that holds or buys vehicle data, the question is the plain one this case turns on. For the last driver your systems collected from, can you produce the screen they accepted, the date they accepted it, and the list of every party that received their data afterwards?

Key facts