Security News

GM Agrees to $220 Million Settlement Over Driver Data Sold Without Consent

The Register · 31 Oct 2026
Key Takeaway If your business runs vehicles or uses connected devices, check what data the vendor collects and who it is shared with, and do not rely on a privacy promise without reading the contract and settings.

General Motors has agreed to a $220 million settlement with 36 attorneys general over how it collected and shared driving data. The Washington state attorney general's office said the data included precise location, speed, seatbelt use and other metrics. Investigators allege GM sold it to data brokers, which supplied it to insurance companies that could use it to set premiums, without drivers' informed consent.

The data was gathered through the Smart Driver program, part of the OnStar offering from a GM subsidiary. The program gave drivers reports meant to improve their driving habits. According to investigators, subscribers did not know their data was also going to brokers, even though GM had told customers it would not share this information with insurers without their express consent. The settlement follows a 2024 New York Times investigation into the practice.

Investigators also said GM incentivised dealerships to enrol customers in Smart Driver, and that in some cases employees accepted terms and conditions on customers' behalf without their knowledge. The OnStar app reportedly told more than 370,000 drivers they were not enrolled, while their data continued to be collected and sold. The Register notes the settlement is under 7 percent of GM's $3.3 billion third quarter net income attributable to stockholders.

data privacy connected vehicles data brokers consent regulatory action

Summarised by CISO AI from The Register, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.