GM Driver Data Settlement: $220 Million to 36 Attorneys General, but No Checks for Drivers

The GM driver data settlement announced on October 29, 2026 requires General Motors to pay $220 million to a coalition of 36 attorneys general, co-led by Oregon and Washington, that accused the automaker of selling Smart Driver driving and location data to brokers who resold it to auto insurers. The money is a state recovery rather than a consumer fund, so drivers receive no checks, and the deal leaves untouched both Texas's separate lawsuit and the private class claims in MDL No. 3115 in Atlanta.

For practitioners the headline number matters less than its structure. The settlement is a set of state-court consent judgments under consumer-protection and privacy statutes. It carries forward-looking consent and data-minimization obligations, includes no admission of liability, and leaves restitution to whoever can still win it. That last point puts the GM driver data settlement next to the federal Wiretap Act and Fair Credit Reporting Act claims that survived GM's motion to dismiss earlier this year.

What the GM driver data settlement covers

The attorneys general describe a single course of conduct. From 2016 to 2024, GM's Smart Driver feature captured how drivers drove (speed, braking, acceleration, late-night trips) together with location data. That information went to two data brokers, LexisNexis Risk Solutions and Verisk, which sold it to insurers. Several state releases say insurers sometimes raised a driver's premium on the strength of those reports.

The enrollment theory is consent. Colorado's attorney general says GM signed consumers up for Smart Driver and OnStar through one process the states call misleading, so many drivers who believed they were activating a connected-car or safety service were also opted into data monetization. The coalition's most concrete allegation is that the OnStar app told more than 370,000 drivers they were not enrolled in Smart Driver when they were, and GM was collecting and selling their data the whole time.

The theory of liability varies by state. Oregon brought its claim under the Unlawful Trade Practices Act, its general consumer-protection statute, because most of the conduct came before Oregon's consumer privacy law took effect in July 2024. Virginia cites both its privacy and its consumer-protection authority. That pairing is typical of the coalition: older conduct is pleaded as deception, and newer state privacy statutes back the injunctive terms.

Coalition membership is reported two ways. Some releases say 36 attorneys general, and Reuters and The Hill say 35 states plus the District of Columbia. Both describe the same 36 signatories. Named participants include Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, Florida, Hawaii, Idaho, Illinois, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, Wisconsin, and the District of Columbia.

What GM has to change under the settlement

The injunctive relief is the part that will outlast the payment. Across the state releases, GM must:

• Obtain affirmative express consent before it collects or discloses consumer driving data or location data. Bundled acceptance of OnStar terms no longer counts.
• Limit what it collects, a data-minimization commitment that cuts against the "collect everything, monetize later" model the states attacked.
• Maintain a comprehensive privacy program that is subject to regular internal and external assessments.
• Oversee dealership practices, because dealers are often where connected-vehicle enrollment happens.

GM's response was brief: "This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices." The company discontinued Smart Driver in June 2024, after press reports about insurers' use of the data, and around the same time it ended its relationships with LexisNexis and Verisk.

Did GM admit wrongdoing?

No. Reuters reports that GM did not admit wrongdoing, and summaries of the consent decree say it contains no admission of the alleged facts or of liability. That is standard for multistate consent judgments. It also means that private plaintiffs gain no issue-preclusive findings from the deal and cannot cite it as proof of the underlying conduct.

How much each state gets from the GM settlement

The coalition did not publish a full allocation schedule, but individual attorneys general announced their shares. The figures below come from those releases.

State	Share announced	Notes
Washington	$12.3 million	Co-lead; covers case costs and fees, according to Courthouse News, and future enforcement, according to the AG's office
Oregon	More than $10.4 million	Co-lead; claim brought under the Unlawful Trade Practices Act
Pennsylvania	About $8.67 million	"Expected" share, per Attorney General Dave Sunday
Maryland	$7.33 million	Attorney General Anthony Brown
Michigan	$7,205,319	Attorney General Dana Nessel; "does not provide consumer restitution"
Colorado	About $7.2 million	Attorney General Phil Weiser
Minnesota	$7,095,664	Attorney General Keith Ellison
Virginia	$6,541,173	Consent judgment filed in Richmond Circuit Court
Connecticut	More than $6 million	Attorney General William Tong

These nine states account for roughly $72.7 million of the $220 million. The remainder is divided among the other 27 coalition members in amounts not yet announced. Each state decides how to use its share. Washington's office says its share will cover litigation costs and future consumer-protection enforcement, and one local outlet reported it as money for residents, which the state's own release does not support.

Do drivers get money from the GM driver data settlement?

Drivers get no money from this settlement. Michigan's attorney general states plainly that it does not provide consumer restitution, and none of the coalition releases, including those of the two lead states, describes a claims process, a claims administrator, or a deadline for drivers. The $220 million is paid to the states.

That has two practical consequences. First, any email or text that promises a "GM data settlement payment" in exchange for personal or banking details should be treated as a scam. Second, a driver's route to individual compensation runs through private litigation, chiefly the consolidated federal class action, or through a state that kept its own case and is seeking restitution, as Nebraska and Arkansas are.

Is Texas part of the GM settlement?

Texas is not part of the multistate deal. Attorney General Ken Paxton sued GM and OnStar in state court in the Houston area in August 2024 under the Texas Deceptive Trade Practices Act. Texas alleges that GM collected driving data from more than 14 million vehicles, including more than 1.8 million vehicles belonging to Texans. That case is ongoing, and Texas is seeking civil penalties and a jury trial.

Texas is not the only holdout. Two other states filed their own suits:

• Arkansas sued GM and OnStar on February 26, 2025 in Phillips County under the Arkansas Deceptive Trade Practices Act, with an unjust-enrichment claim. It alleges that more than 100,000 Arkansans' data was taken without informed consent and seeks disgorgement of GM's data revenue.
• Nebraska sued on July 8, 2025 in Lancaster County District Court. It seeks civil penalties of up to $2,000 per violation, restitution for Nebraskans, and an injunction.

Neither Arkansas nor Nebraska appears in the published rosters reviewed for this article, and neither state has announced a resolution. California settled separately in May 2026 for $12.75 million in civil penalties. That deal, which still requires court approval, imposes a five-year ban on selling driving data to consumer reporting agencies and requires GM to delete retained driver data within 180 days unless customers consent. California also said GM made roughly $20 million nationwide from these data sales. Counting California, GM's announced government payments over Smart Driver total $232.75 million, more than ten times the revenue the states attribute to the program.

Does the GM settlement end the OnStar class action?

No. The attorneys general settled only their own sovereign claims. Private claims by drivers are pending in In re: Consumer Vehicle Driving Data Tracking Litigation, MDL No. 3115. The Judicial Panel on Multidistrict Litigation (JPML) centralized the federal suits in June 2024 before Judge Thomas W. Thrash Jr. in the Northern District of Georgia. The defendants are GM, OnStar, LexisNexis Risk Solutions, and Verisk.

In spring 2026, reports differ on whether the order issued on April 22 or May 3, Judge Thrash granted in part and denied in part the defendants' motions to dismiss a consolidated complaint of about 65 counts. Claims under the federal Wiretap Act, the Stored Communications Act, and the Fair Credit Reporting Act survived, along with invasion-of-privacy and unjust-enrichment theories. Plaintiff-side reports count more than 40 surviving claims against GM. The MDL is now in discovery. No class has been certified, no settlement has been reported, and discovery is expected to run into 2027.

The multistate deal affects that case in three ways:

1. No release of private claims. A state's parens patriae settlement usually does not extinguish individual damages claims unless it creates and distributes a restitution fund, and this one does not.
2. No admission, but a record. GM concedes nothing. Still, the coalition's public allegations, especially the 370,000-driver app misstatement, give MDL plaintiffs a specific, government-endorsed factual narrative to test in discovery.
3. Remedies are already partly imposed. The FTC order, California's judgment, and now the multistate consent judgments impose overlapping injunctive relief. That will narrow any Rule 23(b)(2) injunctive class and push the MDL toward damages under Rule 23(b)(3), where statutory damages under the Wiretap Act and the FCRA matter most.

Timeline of the GM Smart Driver enforcement actions

Date	Action	Forum	Result
2016 to June 2024	Smart Driver data collection and sale to LexisNexis and Verisk	n/a	Program discontinued June 2024
June 2024	JPML centralizes private suits as MDL No. 3115	N.D. Ga. (Judge Thrash)	Pending; in discovery
August 2024	Texas sues under the DTPA	Texas state court	Pending
February 26, 2025	Arkansas sues under the ADTPA	Phillips County, Ark.	Pending
July 8, 2025	Nebraska sues	Lancaster County, Neb.	Pending
January 14, 2026	FTC finalizes consent order	Federal Trade Commission	Five-year ban on disclosure to consumer reporting agencies; 20-year consent regime; no money
Spring 2026	MDL motion-to-dismiss order	N.D. Ga.	Wiretap Act, SCA, and FCRA claims survive
May 2026	California settlement	Cal. state court (subject to approval)	$12.75 million civil penalties
October 29, 2026	36-member AG coalition settlement	State courts (e.g., Richmond Circuit Court)	$220 million; consent, minimization, assessments

The FTC order, finalized January 14, 2026, bars GM for five years from disclosing geolocation and driver-behavior data to consumer reporting agencies. It also requires express consent for connected-vehicle data collection for 20 years and gives consumers access and deletion rights. It carried no monetary penalty, which is why state money became the measure of accountability.

What it means for plaintiffs' counsel, defendants, and insurers

For plaintiffs' and class counsel. The GM driver data settlement removes no claims, and its allegations line up with the MDL's theories. The key evidentiary question is whether enrollment produced real consent, and the 370,000-driver app discrepancy speaks directly to that. Because no restitution was paid, the class damages model has nothing to offset. Lawyers representing Texas, Nebraska, or Arkansas residents should note that those states' cases run in parallel, and Nebraska's and Arkansas's restitution and disgorgement demands could reach residents earlier than a nationwide class could.

For defendants and connected-device companies. The coalition's terms turn "affirmative express consent" into a practical standard for telematics. Consent bundled into a service activation flow is now the specific practice that 36 attorneys general, the FTC, and California have penalized. Companies with similar data-sharing setups (other automakers, usage-based insurance partners, app-based telematics providers) should expect state regulators to use the GM consent judgments as their template. Companies that rely on terms-of-service consent, or on an Arbitration Clause in connected-service terms, to manage private exposure should also note that state enforcement is not bound by consumer arbitration agreements.

For insurers and data brokers. LexisNexis Risk Solutions and Verisk are not parties to the state deal but remain MDL defendants on the FCRA theory, under which a driving score sold to insurers may be a consumer report. The states' statement that insurers used the data to adjust premiums keeps underwriting files relevant in discovery.

For mass-claims practitioners. Large, uniform privacy harms with statutory damages are the kind of matter that, under consumer terms with arbitration provisions, can produce Mass Arbitration filings in place of a single class action. Whether GM's connected-services terms push any of these claims into arbitration has not been publicly decided in MDL 3115, and that is worth watching as discovery and class certification proceed.

FAQ

What is the GM $220 million driver data settlement?

It is an October 29, 2026 agreement in which General Motors pays $220 million to 36 attorneys general (35 states and the District of Columbia), led by Oregon and Washington, to resolve claims that it sold Smart Driver driving and location data to LexisNexis and Verisk for resale to insurers without proper consent.

Do drivers get money from the GM driver data settlement?

No. The payment goes to the participating states, and Michigan's attorney general says the settlement does not provide consumer restitution. No claims process exists for individual drivers.

Which states are in the GM driver data settlement?

The coalition includes 35 states and the District of Columbia, including Oregon, Washington, Pennsylvania, Michigan, Minnesota, Maryland, Colorado, Virginia, Connecticut, New York, Florida, Illinois, New Jersey, and Ohio. Texas is not part of it, and California settled separately for $12.75 million in May 2026.

Did GM admit wrongdoing in the settlement?

No. GM settled without admitting liability, and the company says the agreement addresses Smart Driver, a product it ended in 2024.

Does the GM settlement end the OnStar class action?

No. The private claims consolidated as MDL No. 3115 in the Northern District of Georgia before Judge Thomas W. Thrash Jr. continue. Wiretap Act, Stored Communications Act, and Fair Credit Reporting Act claims survived the motion to dismiss, and the case is in discovery.

What does GM have to change?

GM must obtain affirmative express consent before collecting or disclosing driving and location data, limit the data it collects, maintain a privacy program with internal and external assessments, and oversee dealership enrollment practices. The FTC's separate 20-year order and California's five-year ban on sales to consumer reporting agencies add to these terms.