What happened
General Motors agreed to pay $220 million to settle allegations brought by a coalition of 36 attorneys general, co-led by Washington state, over how it collected and sold driving data. Washington's share is $12.3 million. The settlement was announced by the Washington Attorney General's office on 29 October and reported by The Register the following day.
The conduct ran from 2016 to 2024 through Smart Driver, an OnStar feature that tracked driving behaviour and returned reports to drivers so they could improve. According to the investigation, GM also sold that data to brokers under contracts specifying it was for insurance products. The brokers sold it onward to insurers, which could adjust a driver's premium. Drivers were not told their data would be used this way.
Two details matter. Most enrolments happened at the dealership during a purchase, through a single sign-up flow that bundled Smart Driver with OnStar, and investigators say dealership staff sometimes accepted terms on a customer's behalf. GM was meanwhile rewarding dealerships for enrolment volume, with sales bonuses tied to sign-ups. Separately, the OnStar app told more than 370,000 drivers they were not enrolled when they were, and GM later removed them from the programme without telling them, leaving the data with the brokers.
The settlement requires GM to obtain affirmative express consent before collecting or disclosing driving and location data, limits what it may collect, and obliges the company to run a comprehensive data privacy programme. GM ended Smart Driver in April 2024. It settled related Federal Trade Commission allegations in January 2026, California settled separately for $12.75 million in May, and a Texas case is still open. GM said it stands by connected vehicle data as a safety benefit.
Why this is a GRC story
Consent collected by a partner is consent you still own. Dealership staff closing a sign-up on a customer's behalf is a channel design decision, and it sat on top of a bonus scheme. Any programme that pays a third party per enrolment should assume a share of those sign-ups were not freely given, and should sample the enrolment records rather than assert otherwise.
A broken disclosure is worse than a quiet one. The app that told 370,000 drivers they were not enrolled is the fact most likely to be quoted in any future action against connected product data. A status field that can be wrong invalidates every notice built on top of it, and correcting the record without telling customers turned a data bug into evidence of concealment.
Data sold for one purpose migrates to another. The contracts said insurance products. That sentence is what converted a driving feedback feature into an insurance pricing input, and it is the kind of clause that belongs in a third party register with a purpose review, not a filing cabinet.
What to watch
Texas is the live case. The penalty size is worth thinking about too: $220 million is a small fraction of one quarter's net income, so the real deterrent is the operational consent order, and other connected vehicle, telematics and usage based insurance programmes should expect a version of the same template. Watch also whether state attorneys general go after the data brokers directly. If they do, the broker contract becomes a regulated surface rather than a procurement formality.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.