General Motors will pay $220m to 35 US states and the District of Columbia over drivers' data. The states said GM sold it to data brokers, who sold it on to insurance companies. GM must now get drivers' express consent before it collects or shares their driving and location data.

Washington's attorney general, Nick Brown, announced the settlement on Thursday. Washington and Oregon led the coalition of 36 attorneys general. Oregon's complaint against GM and its OnStar unit is dated the day before. The settlement resolves the states' claims. Washington will receive $12.3m and New York about $12.1m.

“People bought a car, not a tracking device,” Oregon Attorney General Dan Rayfield said in a statement.

What the states say GM did

GM launched Smart Driver in 2015 as part of OnStar, according to Oregon's complaint. It pitched the feature as a way to help people drive more safely. It recorded hard braking, hard acceleration, hard cornering, high speeds, seat belt use, late-night driving and trip times.

That same year, GM started selling OnStar and Smart Driver data to Verisk Analytics, the complaint says. In 2019 it signed a similar deal with LexisNexis Risk Solutions. Both firms turned the data into driver reports and ratings for insurers, and some insurers used them to set rates. GM made more than $20m from these sales nationwide, the complaint says.

Drivers could also join an insurance discount programme, which GM said would share only anonymous data. In fact, GM sold identifiable data on everyone enrolled in Smart Driver, the states allege.

“The data GM sold was personal, identifiable, and specific,” Brown said.

The complaint also covers location data. From 2018, GM collected a car's precise location every three seconds, starting from ignition. From 2019, that data carried an ID that linked it to a vehicle. GM licensed it to Wejo, a UK connected-car data company. In January 2024 Jacobs Engineering bought Wejo's assets and signed its own licence with GM.

Dealers, bonuses and a glitch

Most drivers signed up at the dealership when they bought the car. GM paid dealership staff bonuses based partly on how many customers they enrolled, the attorneys general said. It also ranked dealerships on their numbers. In many cases, staff allegedly accepted the terms on customers' behalf.

If customers tried to decline the OnStar terms, a warning said they would lose crash response and emergency services, the complaint says. GM's app also told more than 370,000 enrolled drivers that they were not in Smart Driver. GM later unenrolled them without telling them, and their data stayed with the brokers and insurers.

From a newspaper story to a settlement

The practice came to light in March 2024, when Kashmir Hill reported for The New York Times that GM shared Smart Driver data with LexisNexis and Verisk. One Chevrolet Bolt owner's insurance rose 21% in 2022. His LexisNexis report listed 640 trips over six months, with start and end times, speeding and hard braking. GM ended Smart Driver in April 2024.

In January 2025, the Federal Trade Commission moved to ban GM from sharing certain driver data with consumer reporting agencies for five years. The FTC finalised that order this January. GM also paid $12.75m to settle similar claims in California in May.

Under the new settlement, GM must also limit the driving data it collects. It must run a data privacy programme with internal and third-party assessments, and train and oversee dealership staff. GM did not admit wrongdoing, and a separate lawsuit from Texas is still going, The Hill reported.

“This agreement addresses Smart Driver, a product we ended in 2024,” GM said in a statement.

GM no longer sells vehicle data that can be linked to a person, the company told TechCrunch. It may still share data that is not tied to a driver. GM is also building its own AI assistant for its cars. Volvo, for its part, offers an app that grades your driving and shares the grade with your insurer. In September, Ireland's data watchdog fined Google €403m over location data.