General Motors agreed to pay $220 million after 36 state attorneys general found it sold millions of drivers’ location and driving behavior data to brokers and insurers without proper consent, sometimes raising their insurance rates. The exact number of individuals affected hasn’t been publicly disclosed, though more than 370,000 drivers were mistakenly told they weren’t enrolled. Affected drivers should check their GM enrollment history and review recent insurance rate changes.
| Company | General Motors |
|---|---|
| Industry | Automotive Technology |
| Data Types Exposed | Location Information, Driving Frequency Data, Trip Start and End Times, Braking and Acceleration Data, Speeding Data |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unauthorized Data Sharing |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the General Motors Data Breach?
General Motors has agreed to pay $220 million to resolve claims that it sold drivers’ private location and driving behavior data without their knowledge. A coalition of 36 state attorneys general, co-led by Washington, brought the case forward. The settlement became public in October 2026, closing out a multistate investigation into the company’s data practices.
According to the investigation, GM enrolled millions of drivers in its Smart Driver program between 2016 and 2024. The company marketed the program as a tool to help people drive more safely. However, investigators found that GM actually sold this driving data to data brokers under contracts that specified the data would be used for insurance purposes.
Those brokers then resold the information to insurance companies, which used it to adjust policyholders’ premiums. As a result, many drivers saw their insurance rates change based on data they never knowingly agreed to share. GM reportedly did not tell drivers their information would end up with insurers.
The investigation also uncovered how enrollment happened in the first place. Most customers signed up for Smart Driver at the dealership when buying a vehicle, often bundled with GM’s OnStar services. In many instances, dealership staff allegedly accepted terms and conditions on a customer’s behalf without getting real consent.
GM reportedly pushed dealerships hard to boost enrollment. Sales employees received bonuses tied to how many customers signed up for connected services, and dealerships were ranked based on enrollment totals. This incentive structure appears to have encouraged shortcuts around proper consent.
Investigators further found a technical failure within GM’s own systems. The OnStar app incorrectly told more than 370,000 drivers that they were not enrolled in Smart Driver, even though they actually were. GM later unenrolled these drivers quietly, without informing them of the error, while their data remained with brokers and insurers.
Who was affected?
This incident affects GM vehicle owners who were enrolled in the Smart Driver program between 2016 and 2024. Because enrollment often happened automatically during the car-buying process, many affected drivers may not have realized they were part of the program at all.
The exact number of individuals affected has not been publicly disclosed. However, the investigation specifically identified more than 370,000 drivers who were mistakenly told they were not enrolled, despite GM continuing to collect and sell their data.
Because this program ran nationally through GM dealerships, the affected population likely spans most states. Anyone who purchased or leased a GM vehicle with OnStar services during this period could potentially be impacted.
What Information Was Potentially Exposed?
The investigation found that GM sold detailed, identifiable driving data tied to individual consumers. This was not anonymized or aggregated information. Instead, it included specific behavioral patterns insurers used to evaluate risk and set rates.
- Location information showing where and when vehicles were driven
- Frequency of vehicle use
- Start and end times of individual drives
- Hard braking and rapid acceleration events
- Instances of speeding above posted limits
This type of data creates real privacy risk because it reveals detailed patterns about a person’s daily life. For example, repeated location and timing data can reveal where someone works, where they live, and their regular routines. In the wrong hands, this kind of behavioral profile could be misused for stalking, harassment, or targeted scams.
There is also a financial dimension to this risk. Because insurers used this data to adjust premiums, affected drivers may have paid more for insurance without ever knowing why. This raises concerns about fairness and whether consumers had any real opportunity to contest decisions based on data they didn’t know was being shared.
What is the company doing?
As part of the settlement, GM has agreed to a series of corrective measures. The company must now obtain affirmative express consent from consumers before collecting or sharing driving and location data going forward. This marks a significant change from its prior sign-up process.
In addition, GM discontinued the Smart Driver program entirely after press reporting exposed these practices. The settlement also requires GM to limit the types of driving data it collects and to build out a comprehensive data privacy program moving forward.
GM further agreed to undergo both internal and external assessments of its data protection practices. The company must also implement new oversight and training requirements at its dealerships. This is meant to prevent customers from being enrolled in data collection programs without clear, informed consent in the future.
What Should Affected Individuals Do?
Review Your GM Vehicle Enrollment History
If you purchased or leased a GM vehicle between 2016 and 2024, check whether you were enrolled in Smart Driver or OnStar connected services. Look through your dealership paperwork and any account settings in the OnStar app or online portal.
Because enrollment sometimes happened without clear consumer consent, you may have been enrolled without realizing it. Contacting GM customer service directly can help you confirm your enrollment status and request details about what data was collected.
Check Your Auto Insurance History for Rate Changes
If your insurance premiums increased unexpectedly during this period, it may be worth asking your insurer whether driving behavior data played a role. Insurance companies are generally required to disclose when they use third-party data to set rates.
Requesting this information can help you understand whether you were affected financially. If you believe you were charged unfairly based on data you never agreed to share, documenting this can support any future claims or complaints.
Monitor for Identity Theft and Unusual Activity
Even though this incident centers on driving and location data rather than financial account numbers, it’s still wise to monitor your credit report regularly. Identity thieves sometimes combine seemingly unrelated data points to build a fuller profile for fraud.
You can request free credit reports from the three major credit bureaus each year. Reviewing these reports regularly helps you catch unfamiliar accounts or inquiries early, before they cause lasting damage.
Stay Alert to Phishing Attempts
Whenever a major data privacy settlement makes headlines, scammers often try to take advantage of public attention. Be cautious of emails or texts claiming to be from GM, OnStar, or a settlement administrator asking for personal information.
Instead, verify any communication by going directly to GM’s official website or contacting customer service through a known phone number. Never click links in unsolicited messages promising settlement payments or account verification.
Consider Consulting a Data Privacy Attorney
If you believe your data was sold without consent and used to raise your insurance rates, you may want to speak with an attorney who handles data privacy cases. They can help you understand whether you have grounds for an individual claim beyond the multistate settlement.
Many attorneys offer free initial consultations for cases like this. This means you can explore your options without any upfront cost or obligation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.