GM and affiliates face a $220 million multistate consent judgment over connected-car data practices.
Why it matters: The order would require affirmative consent, deletion requests and tighter privacy governance for driving and location data. It also limits disclosures to consumer-reporting agencies and illustrates coordinated state enforcement, rather than establishing a new federal privacy law.
- The consent judgment covers 35 states and the District of Columbia and resolves allegations involving GM, General Motors Holdings and OnStar.
- The order says GM's Smart Driver program enrolled millions of drivers from approximately 2016 through 2024.
- GM must obtain affirmative express consent before collecting, using or disclosing covered driving and location data to third parties, subject to defined exceptions.
- The order takes effect November 30, 2026; the payment is due within 30 days, and GM must seek deletion of data disclosed before January 16, 2025.
General Motors, General Motors Holdings and OnStar are parties to a consent judgment dated October 29, 2026 that would require them to pay $220 million to resolve allegations brought by 36 attorneys general. The allegations concern the collection and disclosure of consumers' driving-behavior and location data without adequate consent. The judgment takes effect November 30, 2026.
The attorneys general alleged that GM's Smart Driver program enrolled millions of drivers from approximately 2016 through 2024. The driving and location data covered by the order included precise location, hard braking, speeding, seat-belt use, late-night driving and trip timing. The allegations say GM disclosed or licensed the data to brokers including LexisNexis Risk Solutions and Verisk for products that could be sold to auto insurers. GM discontinued Smart Driver in April 2024, according to the consent judgment.
The order requires separate affirmative express consent for each unrelated service or feature that collects, uses or discloses the data. Silence, inactivity, prechecked boxes, broad terms of use and interfaces that impair user choice do not qualify. Exceptions include emergency response, vehicle safety, diagnostics, recalls, legal compliance and certain deidentified research.
GM must create a comprehensive privacy program, appoint a chief privacy officer, assess high-risk processing and maintain a data inventory. It must also ask third parties to delete data disclosed before January 16, 2025. GM cannot resume selling or disclosing data to a previously used consumer-reporting agency until deletion or a legal-retention exception is confirmed.
The consent judgment sets January 13, 2046 as the end date for obligations subject to that provision; it does not establish that every requirement ends on that date. The payment is due within 30 days after the judgment takes effect. The order does not appear to create a private compensation fund.
The multistate action follows a separate Federal Trade Commission order finalized in January 2026 and a $12.75 million California settlement announced in May 2026. The materials reviewed here do not establish how many individual drivers were affected.
By the numbers
- $220 million - payment required under the multistate consent judgment
- 36 attorneys general - representatives of 35 states and the District of Columbia
- 2016-2024 - approximate period in which the order says Smart Driver enrolled millions of drivers
Yes, but: The settlement resolves allegations through a consent judgment; it is not presented here as a finding after trial. The reviewed materials also do not establish the number of affected drivers or include a GM statement responding to the allegations.
What's next: The consent judgment takes effect November 30, 2026. Payment is due within 30 days afterward, and the order sets January 13, 2046 as the end date for obligations subject to that provision.