General Motors has agreed to pay $220 million to resolve a data-privacy lawsuit brought by the attorneys general of 35 US states and the District of Columbia. The dispute centers on the automaker’s OnStar Smart Driver program, which collected detailed driving-behavior information from customers between 2016 and 2024 and, the states alleged, sent that information into a pipeline used for insurance purposes without properly informing or obtaining permission from those drivers.

The settlement is significant not merely because of its size, but because it addresses a modern car’s uncomfortable second identity: it is both transportation and a connected data-gathering device. The allegations involve information on hard braking, speeding and late-night driving—actions that can sound mundane in isolation but can become consequential when linked to an identifiable person and used to influence insurance decisions.

Under the agreement, GM must limit its collection of customer driving data, protect personal information, undergo internal and outside assessments of its privacy and data-protection programs, provide further oversight and conduct added dealership training. It follows a separate federal restriction earlier this year that bars GM from sharing certain consumer data with third parties for five years. GM also reached a separate $12.75 million settlement with California in May.

What the states said happened

The attorneys general alleged that GM enrolled millions of customers in Smart Driver from 2016 through 2024. The program tracked selected driving habits, including hard braking, late-night driving and speeding. The data was then sold to data brokers serving the insurance industry, where it could be used by insurers in decisions that resulted in higher premiums for some people.

The core complaint was not simply that data existed. Modern connected services often collect data to operate features, maintain systems, improve products or deliver an explicitly selected service. The issue alleged here is notice and consent: customers were allegedly not told that their driving information would be sold for insurance-related use, and many were allegedly not even informed that they had been enrolled in the Smart Driver program.

That distinction matters. A driver might reasonably expect a connected-vehicle service to need some information for the service they select. That expectation changes materially if the information is personally identifiable, specific to their driving, and distributed onward to an ecosystem whose participants can make financial judgments about them. In this case, the states characterized the information as personal, identifiable and specific.

The states further alleged that GM encouraged dealers to enroll as many customers as possible by offering bonuses. In some instances, dealership employees allegedly accepted Smart Driver terms and conditions on customers’ behalf without their express authorization. The allegations therefore reach beyond software settings and account screens to the point of sale, where a customer may be completing a vehicle purchase amid a large volume of documents, feature explanations and account setup choices.

The enrollment error is especially important

One of the most striking claims concerns more than 370,000 drivers who were told they were not enrolled in Smart Driver even though they were. GM later removed those customers from the program, but the states said the company did not tell them about the mistake and continued to sell their data.

From a privacy-management perspective, an inaccurate enrollment status creates a serious problem. A choice to participate only has practical meaning when a company’s records accurately reflect it. Likewise, an assurance that someone is not participating is valuable only if the company’s systems, vendors and data flows operate on that same understanding.

This is why the settlement’s emphasis on assessments, oversight and dealership training is notable. Consent is not a single box checked at the beginning of a relationship. It is a process involving enrollment, recordkeeping, communication, collection, sharing, correction and removal. A failure at any one step can undermine the customer’s understanding of what is happening to their information; failures across several steps can turn an optional program into something much harder for people to recognize or control.

Explaining the technical and business terms

Connected-vehicle data

Connected-vehicle data is information generated, recorded or transmitted by a vehicle and related services. In the Smart Driver matter, the relevant information was driving-behavior data: signals about how and when a vehicle was driven. The reported categories—hard braking, speeding and late-night driving—are examples of behavior signals rather than simply basic vehicle identifiers.

On their own, behavior signals can appear abstract: a braking event, a time of travel, an indication of speed. When tied to a particular consumer, however, they can form a profile. The states’ description of the data as identifiable is central because it means this was not framed as merely anonymous aggregate analysis about broad driving trends.

Data brokers

A data broker is an intermediary that receives data and makes it available to other businesses. In the allegations against GM, brokers were the link between collected driving information and insurance-related use. That intermediary role can make a data path less visible to consumers. A customer may understand that they are dealing with a carmaker, but may not realize that information can move from the manufacturer to a broker and then to companies making decisions outside the original vehicle-service relationship.

Insurance underwriting and premiums

Insurance underwriting is the process by which an insurer evaluates risk in setting the terms and price of coverage. A premium is the amount a policyholder pays for that coverage. The states said insurance companies raised premiums for people using information stemming from the program. That makes the alleged sharing more tangible than a conventional advertising-data controversy: the disputed data could affect a recurring household expense.

It is also why precision about consent matters. A consumer might have a different view of sharing data intended to support an in-car service than they would of sharing information that may shape the cost of insurance. The settlement does not erase that distinction; it places new obligations around GM’s data practices going forward.

What GM must do under the settlement

The settlement requires GM to limit the driving data it collects from customers and to protect their personal information. It also imposes mandated internal and external assessments of the company’s data-protection and privacy programs, plus oversight and additional training for dealerships.

Each part addresses a different layer of the alleged conduct:

  • Limits on collection address the amount and type of driving information entering GM’s systems in the first place.
  • Personal-information protections address how sensitive and identifiable data is handled once collected.
  • Internal assessments require the company to evaluate its own privacy and protection practices.
  • External assessments add review beyond the company’s own processes.
  • Oversight creates a mechanism for monitoring compliance rather than treating the payment as the end of the matter.
  • Dealership training focuses on the customer-enrollment point that featured prominently in the states’ allegations.

Those requirements are consequential because the alleged problem was not limited to a single data transfer. It involved how customers were put into the program, whether they were told, whether their stated status was accurate, and what happened to the resulting information. A remedy focused only on one downstream recipient would not address all of those stages.

The federal and California actions add context

The multi-state settlement sits alongside two other actions described in the case history. Earlier this year, the Federal Trade Commission banned GM from sharing specific consumer data with third parties for five years in connection with this issue. In May, GM reached the separate California settlement for $12.75 million.

These actions should not be collapsed into one figure or treated as one proceeding. The $220 million agreement resolves the action by 35 states and the District of Columbia; the California agreement was separate; and the federal action imposed a five-year prohibition on sharing specified consumer data with third parties. Together, though, they show that the Smart Driver matter has drawn scrutiny at state and federal levels.

Connected transportation remains an area of active development, including work on autonomous services such as planned autonomous bZ4X robotaxi testing in Japan. The GM settlement is a reminder that as vehicle technology becomes more software-connected, the governance of the data generated around that technology can be as important to customers as the feature set itself.

Practical implications for vehicle owners

This settlement is specifically about GM and Smart Driver, so drivers should not assume that its exact terms automatically apply to every automaker or connected-car program. But it offers a useful lens for any owner considering an app, telematics feature, rewards program or insurance-linked driving service.

First, distinguish between the service’s immediate function and its sharing terms. A feature may describe safety feedback, driving insights or account benefits, while its terms may set out separate rules for data collection and third-party sharing. Second, enrollment matters: ask whether participation is opt-in, whether a dealer can set it up during a sale, and how to verify status after leaving the dealership.

Third, pay close attention to whether driving data is identifiable and whether it may be shared with brokers, insurers or other third parties. “Third party” is a broad phrase, and consumers should understand what category of recipient it covers in the service they are evaluating. Finally, keep records of an enrollment or opt-out decision and any confirmation supplied by the company. The allegation involving drivers who received inaccurate enrollment information illustrates why confirmation is meaningful only when the company’s systems honor it.

For GM, the $220 million payment is substantial, but the operational changes may prove just as important. New limits, assessments, oversight and dealer training place the focus on whether privacy controls work throughout the customer journey. For customers, the case makes a plain point: data from ordinary driving can travel farther—and matter more financially—than the dashboard may suggest.