General Motors will pay $220 million to resolve a multi-state lawsuit alleging the company illegally sold private driver behavior and location data to third parties. The settlement, announced by a coalition of 36 attorneys general, addresses claims that GM's Smart Driver program, active from 2016 to 2024, collected detailed driving habits and then sold this information to data brokers. These brokers subsequently provided the data to insurance companies, which in some cases used it to set or increase customer premiums.The lawsuit contended that GM marketed its Smart Driver program as a tool for improving driving safety and assured customers their data would not be shared with insurers without express consent. However, investigations by the attorneys general found that GM sold this information under contracts that specified its use for insurance products. This practice was not disclosed to drivers.The data collected included details such as the start and end times of trips, instances of hard braking, rapid acceleration, speeding, and how frequently a customer drove. Insurance companies reportedly purchased these reports to assess risk and calculate premiums, leading to premium increases for some drivers.A significant aspect of the allegations involved how customers were enrolled in the Smart Driver program. Many drivers reportedly signed up at GM dealerships when purchasing their vehicles, often through a combined process with GM's OnStar services. The investigation found instances where dealership employees allegedly accepted terms and conditions on behalf of customers without their explicit consent. GM had incentivized dealerships to maximize OnStar sign-ups, including for Smart Driver.Furthermore, the attorneys general stated that more than 370,000 drivers were incorrectly informed via the OnStar app that they were not enrolled in Smart Driver, while GM continued to collect and sell their data. GM later unenrolled these customers without notifying them of the error, and the previously collected data remained with data brokers and insurers.The settlement requires GM to obtain affirmative express consent from consumers before collecting or disclosing any driving or location data. It also mandates that GM limit the driving data it collects and implement a comprehensive data privacy program to protect personal information. The company will undergo internal and external assessments of its data protection and privacy program and implement oversight and training requirements at its dealerships to prevent unauthorized data collection enrollment.This multi-state agreement follows earlier regulatory actions against GM regarding its connected-car data practices. In January 2025, GM reached an agreement with the Federal Trade Commission, which imposed a five-year ban on disclosing certain vehicle geolocation and driver behavior data to consumer reporting agencies. California also settled with GM in May 2026 for $12.75 million over similar allegations of selling driving information to data brokers.A GM spokesperson stated that the company ended its Smart Driver product in 2024 and has since strengthened its privacy practices. The spokesperson affirmed GM's commitment to transparency regarding data usage, protection, and customer choices. The $220 million from this settlement will be distributed among the participating states, with Washington receiving $12.3 million and Oregon more than $10.4 million. A separate nationwide class-action lawsuit seeking monetary damages for affected customers remains pending.