A dealership tick-box is not consent. Thirty-six attorneys general got $220 million from GM and a rule that driving data needs a separate, affirmative yes.
From 2015 GM offered Smart Driver as part of OnStar and promoted it as a way for drivers to improve their driving. The Oregon complaint alleges GM sold identifiable Smart Driver data to Verisk from 2015 and to LexisNexis Risk Solutions from 2019, which built driver reports sold to insurers, some of whom used them in setting rates. Most enrollment happened at the dealership in a single OnStar sign-up. GM paid dealership staff incentives tied to enrollment, and in many cases employees allegedly accepted the terms for customers. GM's apps told over 370,000 consumers they were not enrolled when they were (Oregon complaint; Oregon DOJ).
| Term | Requirement |
|---|---|
| Consent | Affirmative express consent before collecting or sharing covered driver data, with a separate consent where required; broad terms of use, or closing or muting content, do not count |
| Withdrawal | Consumers must be able to withhold or withdraw consent |
| Existing users | Notice to people enrolled in OnStar before the effective date; deletion of previously retained data unless consent is given |
| Dealers | Oversight and training so customers are not enrolled without consent |
| Program | Data minimization, a comprehensive privacy program, internal and third-party assessments |
| Money | $220 million within 30 days of the 30 November 2026 effective date, divided among the states |
Terms summarized from the Oregon stipulated general judgment and Oregon DOJ release. GM entered the judgment without admitting the allegations.
Inth's technical interpretation: consent has to be captured from the person whose data it is, for that purpose, and recorded. A bundled terms acceptance, or one entered by a salesperson, leaves no record that the consumer chose. Store purpose-level consent with who gave it and where, and make the status screen read the same record the data pipeline does.
// Driving-data sharing enabled by the general terms acceptance at the dealership
if (account.acceptedTerms) shareDrivingData(broker);
// Separate, purpose-specific consent recorded from the driver
if (consent.has('driving-data-third-party', { subject: driver.id })) {
shareDrivingData(broker);
}
| Date | Event |
|---|---|
| 2015 | Smart Driver launches; sales to Verisk begin (alleged) |
| 2019 | Contract with LexisNexis Risk Solutions (alleged) |
| April 2024 | GM announces it is discontinuing Smart Driver |
| 28 October 2026 | Oregon complaint dated |
| 29 October 2026 | 36 attorneys general announce the $220 million settlement |
| 30 November 2026 | Effective date of the judgment |
| By 30 December 2026 | Payment due (within 30 days of the effective date) |
GM agreed to stipulated judgments with 35 states and the District of Columbia. It will pay $220 million, including $10,460,649 to Oregon, and must meet consent, data-limitation, dealer-oversight and assessment terms (Oregon judgment). New York says it receives more than $12 million (New York AG). Montana is not on the coalition list and is suing GM separately (Montana v. General Motors).
| Item | Amount | Source |
|---|---|---|
| Total payment | $220 million | Oregon judgment |
| Oregon share | $10,460,649 | Oregon judgment |
| New York share | More than $12 million | New York AG |
Records purpose-level consent from the person using the product, with who, when, where and which notice, so a bundled acceptance is never mistaken for consent to sharing.
Checks websites for third-party requests before a choice and after a refusal. It does not see vehicle telematics or server-side broker feeds.
Consent records per purpose with policy version and timestamp.
Start a free scanYour ticks stay on this page. Inth does not save or send them.
The Oregon judgment, Oregon complaint and both press releases were opened. The other 35 jurisdictions' judgments were not opened; the Oregon judgment says they are similar. The Oregon case number was not shown on the copy reviewed.
Source review: 30 October 2026. This page describes the cited record and procedural stage. It does not audit the company's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.