GM's $220 million driver-data settlement requires explicit consent

General Motors will pay $220 million under a settlement announced by a coalition of 36 attorneys general on October 29, 2026, over allegations that it sold driving and location data without consent. The agreement requires affirmative, express consent for collecting or disclosing covered driving and location data.

For owners reading about a "payout," an important detail is in Michigan's announcement: the settlement does not provide consumer restitution. A separate private class action seeking money remains pending. The October 29 agreement predates CNET's originating report of October 30.

How driving feedback became insurance data

The states allege that GM enrolled drivers in Smart Driver, presented as a way to improve driving habits, while selling information to brokers under contracts specifying insurance uses. Those brokers then supplied insurers, which could use the information when setting premiums.

The distinction matters because feedback to a driver and disclosure for another company's insurance decisions serve different purposes. Agreement to one purpose does not explain the other to the person whose journeys are being recorded.

Smart Driver's closure is older history. In an April 24, 2024 statement, GM announced plans to discontinue the product and unenroll customers. It also said sharing with LexisNexis and Verisk had ended on March 20, 2024. That dated statement should not be read as a newly announced shutdown.

Consent has to survive the dealership enrollment process

Oregon's account of the agreement describes requirements to limit data collection, maintain a privacy program, undergo internal and external assessments, and train and oversee dealerships.

Those dealership obligations address a specific allegation: in many cases, employees accepted terms on customers' behalf without their consent. A privacy setting presented after enrollment cannot, by itself, show what the buyer understood at the point of sign-up.

For the next connected-service enrollment, ask what data is collected, which purposes are optional and who receives it. Keep the answers and the consent record together so later account settings can be checked against them.

Use the current privacy request routes

GM's U.S. privacy statement, updated June 17, 2026, describes access, correction and deletion requests. It directs consumers to its privacy request form or telephone channel and says ordinary consumer privacy requests are not accepted by email.

The statement also separates GM's practices from independent dealer practices and third-party services. Owners investigating a particular data flow may therefore need to check the relevant provider's own disclosures as well. The settlement's announcement does not establish that any individual driver's insurance premium will change.

Sources

• Michigan's settlement announcement

• Oregon's settlement requirements

• GM's April 2024 Smart Driver statement

• GM's current U.S. privacy statement