On Thursday, October 29, General Motors agreed to pay $220 million to settle claims from the attorneys general of 35 states and Washington, DC. The claims cover one of the longest-running consumer data sales in the auto industry: for eight years, GM collected detailed driving data through its OnStar Smart Driver feature and sold it to data brokers, who turned it into scores that insurers used, in part, to set drivers’ rates.

GM did not admit wrongdoing in the settlement. Smart Driver was shut down in 2024. The money is the headline, but the settlement’s real weight sits in the operating rules GM now has to follow — and those rules are a template every business that collects customer data should read carefully.

What GM Collected, and Where It Went

Smart Driver was pitched to drivers as a coaching tool: feedback on braking, acceleration, and driving habits, presented as a way to become a safer driver. Underneath the coaching, the system collected hard braking and acceleration events, speeding, late-night driving, seat-belt use, and precise location — tied to the identity of the driver.

That data did not stay inside GM. The company sold it to data brokers — Verisk starting in 2015 and LexisNexis Risk Solutions starting in 2019. The brokers converted the driving data into driver scores, and insurers used those scores as one input in pricing. A driver could brake hard to avoid an accident, drive home late from a shift, and see the cost of that behavior show up in an insurance premium — without ever knowing a score existed.

370,000 Drivers Were Told They Were Not Enrolled

The sharpest fact in the case concerns consent. More than 370,000 drivers were told by the app that they were not enrolled in Smart Driver when they actually were. Their data was collected and sold anyway.

GM called the arrangement consent. The record shows theatre: a friendly label, a coaching dashboard, a reassurance on the screen — and a data sale running underneath all three. Whatever a driver tapped, declined, or believed about the feature, the pipeline to the brokers kept moving. Real consent has to be understandable, verifiable, and revocable. GM’s version was none of the three.

This is the point regulators have now priced. A consent screen nobody understands, accepted at a dealership or buried in an app menu, no longer counts as protection for the company holding it.

The Settlement’s Rules Matter More Than the Money

The $220 million is a one-time cost for a company of GM’s size. The forward-looking terms change how GM has to operate every day:

• Affirmative express consent is now required before GM collects or discloses driving or location data.
• Collection limits restrict what gets gathered in the first place.
• A standing privacy program with internal and external assessments must review how the company handles this data.
• Dealer oversight and training must ensure dealership staff cannot click through consent on a buyer’s behalf.

The Washington consent decree’s terms take effect November 30, 2026. Read the four requirements again and notice what they target: the moment of consent, the volume of collection, outside verification, and the humans at the point of sale. The settlement treats privacy as an operating system, not a legal document.

GM is also not dealing with one settlement in isolation. In January 2026, the FTC finalized an order banning GM from sharing driver data with consumer reporting agencies for five years and requiring consent for twenty. California settled its own case separately in May 2026 for $12.75 million. State attorneys general, the FTC, and California have now each taken a layer of the same conduct — and every layer points the same direction.

What This Means for Any Business That Collects Customer Data

Most businesses will never sell data to a broker. Many still run a smaller version of GM’s mistake: a signup flow nobody reads, a vendor integration nobody reviewed, a data feed switched on during onboarding and never revisited. The settlement terms translate directly into a working checklist:

1. Make consent provable. If a customer agreed to data collection, you should be able to show what they saw, what they accepted, and when. If the honest answer is “the app handled it,” you have GM’s problem at your scale.
2. Collect less on purpose. Every field, sensor, and log you keep is a liability you carry. The settlement imposes collection limits on GM because unlimited collection created unlimited exposure.
3. Assess yourself before a regulator does. External privacy assessments are now a settlement obligation for GM. Run voluntarily, the same review is how a smaller company finds its Smart Driver — the forgotten feature still feeding data somewhere — while fixing it is still cheap.
4. Train the people at the point of signup. The decree reaches all the way to dealer staff because that is where consent was weakest. Your equivalent is whoever onboards customers, connects tools, or pastes data into new systems.
5. Know where data flows after it leaves you. GM’s exposure multiplied when brokers and insurers entered the chain. Every integration, export, and vendor account extends your data into rooms you do not control.

None of this requires a compliance department. It requires written rules, a record of consent, and a named person who owns both. Companies that build that system now are copying the settlement’s terms voluntarily. Companies that wait will receive the same terms the way GM did.

What Drivers Should Check This Week

You do not need a GM vehicle to use this checklist — every major automaker runs connected services with similar mechanics:

• Check your connected-services enrolment. Open your car’s app and find the driving-data or “smart driver” style feature. Confirm whether it is on, and whether you remember turning it on.
• Review location sharing. Turn off the location permissions you do not use, in the car and in the manufacturer’s phone app.
• Ask the unenrol question. If you switch a data feature off, ask the manufacturer what happens to the data already collected. In GM’s case, drivers who believed they were out were still in — so get the answer in writing where you can.
• Separate the bargains. An insurer’s own telematics program, where you knowingly trade driving data for a discount, is an explicit deal. A car quietly scoring you in the background is a different arrangement. Know which one you are in.

Treat your car like your phone: a connected device with settings worth auditing twice a year.

Where to Start

The governance work above is document work: a data rules policy, a record of what your tools collect and where it flows, a vendor review before you connect anything new, and an incident plan for the day something surfaces. The AI Governance Starter Kit from Combs Intelligence Group gives you those working documents as fill-in templates — an AI use policy, a risk register, a vendor scorecard, an approval workflow, and an incident playbook — built for small and mid-sized teams. It is $197, and the same system that governs AI tools governs any data your business collects, including the kind that just cost GM $220 million.

Get the kit here: The AI Governance Starter Kit

From Combs Intelligence Group, published on Big Jerm Says.

Big Jerm