Regulation

General Motors will pay $220 million to settle claims by 36 attorneys general (35 states and the District of Columbia) that it sold drivers' behaviour and location data without telling them. The states announced the deal on October 29, 2026, with Oregon and Washington leading. From 2016 to 2024, GM enrolled millions of drivers in OnStar Smart Driver, a feature sold as driving feedback, and passed the data to brokers who resold it to insurers. GM admits no liability and says it ended Smart Driver in 2024.

If your company collects telemetry, location or app usage data and shares any of it, read the injunctive terms. Oregon published the stipulated judgment, and it reads like a privacy engineering specification: a precise definition of consent, a ban on bundling consent into terms of service, deletion deadlines, a public retention schedule, vendor contract clauses and independent audits, most of them binding until January 13, 2046. Expect regulators to measure other companies against the same terms.

What GM is alleged to have done

The Oregon complaint describes two data flows. Through Smart Driver, vehicles recorded trip counts, start and end times, hard braking, rapid acceleration and speeding. GM sold this to Verisk Analytics and LexisNexis Risk Solutions, which built driver ratings and consumer reports that insurers used, in part, to set premiums. GM made more than $20 million nationwide from those sales. Separately, from 2018 GM collected precise location every three seconds from ignition on to ignition off, linked to the car's VIN (Vehicle Identification Number), and licensed it to the UK firm Wejo and later to Jacobs Engineering.

Most drivers were enrolled at the dealership, in the same set of screens that activated OnStar, and the complaint says GM paid dealership staff incentives for enrolments and that staff sometimes clicked "I accept" for the customer. The privacy statement mentioned sharing with insurers only where the driver had separately authorised it. GM's apps also told more than 370,000 people they were not enrolled when they were; after the New York Times reported in April 2024, GM quietly unenrolled them, and the data already sold stayed with brokers and insurers.

GM has now settled with the Federal Trade Commission (FTC, January 2025, no fine), California ($12.75 million, May 2026) and these 36 attorneys general. Texas is still suing.

What the judgment requires

The judgment defines "Covered Driver Data" broadly: location, plus driving events (hard braking, hard acceleration, hard cornering, high speed, seat belt use, late-night driving) and radio listening data, whenever linked or reasonably linkable to a person. Data still tied to a VIN or a garage address is not treated as deidentified. Location coarser than about 1,850 feet, or used only to derive that and deleted within 48 hours, is out of scope.

Consent has to be a clear affirmative act after a disclosure that is separate from the privacy policy and terms of service. Hovering, closing a banner, pre-ticked boxes, silence and acceptance of broad terms do not count, and neither does an interface that "subverts or impairs" choice. Each unrelated feature needs its own consent, and if data goes to a third party for usage-based insurance, the disclosure has to say so. The consent screen must name the third parties, or link to a maintained list of them. Withdrawing consent cannot be punished by degrading a feature unless the data is technically needed for it.

For data already collected, GM must delete everything retained from before January 16, 2025 within 180 days of the November 30 effective date, apart from listed exceptions such as litigation holds, recalls, warranty and safety work. It may email drivers once asking to keep their data, and silence after 30 days means deletion. It must ask every earlier recipient to delete what it received, and may not sell to a consumer reporting agency again until that agency confirms the deletion in writing.

The governance terms are where engineering and procurement come in. GM needs a chief privacy officer who reports to the board at least annually and to the general counsel at least quarterly, a data protection assessment before any new sale of driver data or new location sharing with a third party, an inventory of the OnStar data shared with third parties, and internal and public retention schedules that name a deletion timeframe per data type. New vendor contracts must restrict use to stated purposes and require deletion or return at the end of the service. GM must check that vendors keep to those terms, corroborate self-assessment questionnaires, and act when a vendor does not. An independent assessor reviews the programme within the first year and then every two years for four more years. Within 60 days dealers must be trained so customers accept the terms themselves, and within 180 days existing OnStar users get a notice pointing to the new consent screen. Drivers must also be able to switch off location collection in the vehicle. The assessment, inventory and vendor terms expire after ten years; the rest run to 2046.

What to change if you handle telematics or consumer data

The judgment binds GM alone, but its terms track the consumer privacy laws now in force in many states, and Connecticut opened its investigation with a notice of violation under its Data Privacy Act. If your company runs a fleet platform, a connected device, a mobile app with location, or any data feed sold to partners, work through this list:

1. Build a data map for every telemetry field: what is collected, how often, what identifier it is joined to, which systems store it and which outside parties receive it. Treat a VIN, device ID or advertising ID as personal data when it travels with location or behaviour.
2. Pull consent for each data-sharing purpose out of your terms of service into its own screen. Keep the consent record (which notice, which version, timestamp, user) for as long as you rely on it; GM must keep these records for five years.
3. Check where consent is captured on someone's behalf: dealers, installers, field technicians, resellers, onboarding staff. GM's worst failures happened at a dealership counter, which is why the judgment makes it sample enrolments and train dealers. If anyone is paid per enrolment, sample enrolments for odd patterns, such as many accepted within seconds of each other or all from one account.
4. Write a retention schedule per data type with a deletion period, and run a job that enforces it. Location used only for coarse analytics can be reduced and deleted within days.
5. List every party that receives raw data, including analytics SDKs, data brokers and "research" partners. Make sure each contract limits purpose, bars onward sale and requires deletion at the end, and confirm that the data you send matches what the contract allows.
6. Test the user flows: can someone withdraw consent, request a copy (GM must answer within 45 days) and request deletion, without losing features that do not need the data?

If you are on the buying side, ask your telematics and fleet suppliers whether any data is sold to consumer reporting agencies or insurers, and for their retention schedule. Our earlier post on car companion apps sending VINs and location to trackers covers the fleet and phone settings.

If you want a review of what your products collect and share, or help preparing for a privacy audit, see our compliance and audit readiness and attack surface management services. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: The Record, Oregon Department of Justice, Oregon stipulated general judgment, Oregon complaint, Connecticut Attorney General, Arizona Attorney General, Engadget, TechCrunch on the California settlement, CyberInsider on the FTC case.