General Motors has agreed to pay $220 million to resolve allegations that it sold drivers’ behavior and location data without their knowledge or consent. Announced October 29, 2026, the agreement involves 35 states and the District of Columbia, co-led by Washington and Oregon. The agreement follows separate OnStar settlements with the FTC and California. According to the Colorado complaint, GM promoted Smart Driver, an OnStar features, as a driving-improvement tool but sold participants’ identifiable data to third parties for insurance purposes. GM discontinued Smart Driver in April 2024.
In settling with the multistate group, GM has agreed, among other things, to the following:
- Data sharing. GM agreed to obtain affirmative express consent before disclosing covered driver data to third parties (including consumer reporting agencies), including a disclosure that data shared for usage-based insurance may be used for rates or coverage. This is similar to the agreement reached with California, but unlike the FTC settlement, where the company has agreed not to share driver data with consumer reporting agencies for a five year period.
- Deletion. GM agreed to delete covered driver data retained before January 16, 2025, subject to specified retention exceptions and provisions addressing consent and deidentification. GM had previously agreed with the FTC and California, however, to delete data retained before the dates when their respective orders and judgments enter into force. Like its settlements with the FTC and California, GM agreed to ask third parties to delete information previously disclosed. Unlike the earlier settlements, in the multistate settlement GM agreed to get written confirmation of deletion or the legal or regulatory requirement preventing deletion before continuing to share covered data with those entities.
- Consumer controls. GM agreed to provide access and deletion mechanisms, allow location collection to be disabled where technologically supported, and allow remote data collection to be disabled when customers decline or leave OnStar, subject to exceptions. Copy requests generally have a 45-day processing deadline; deletion follows applicable state law, with a specified 60-day process where statutory deletion rights are unavailable. The basic controls overlap with the FTC order and California judgment, but the multistate decree supplies more detailed request-handling rules.
- Privacy governance. GM agreed to maintain a comprehensive privacy program, designate a responsible Chief Privacy Officer, report to executives and the board, assess new high-risk processing, and obtain independent assessments of the program and its controls. GM agreed to similar privacy governance provisions with California, although the multistate agreement adds a prescribed independent-assessor process and more detailed organizational oversight. (The FTC settlement did also require safeguards and compliance reporting.)
- Dealer oversight. GM agreed to implement enrollment procedures requiring independent customer action and dealer training materials, similar to terms reached with California. Customers who do not act within ten days of an enrollment notice are treated as declining OnStar. GM also agreed to periodically sample enrollments for unusual patterns indicating possible dealer noncompliance.
Putting it Into Practice. This settlement can inform how businesses beyond car manufacturers provide notice, obtain consent, and share personal data. The terms of the settlement suggest what states expect from companies, including informed consent and management and oversight of third party recipients of information. It also suggests what steps to take when others are providing notice or getting consent on the company’s behalf.