[Enforcement library](/enforcement)

# 36 attorneys general and GM: $220 million over Smart Driver data sold to insurers

A coalition of 36 attorneys general led by Oregon and Washington alleged GM enrolled drivers in OnStar Smart Driver, often at the dealership and sometimes with staff accepting terms for them, then sold identifiable driving data to Verisk and LexisNexis, whose reports reached insurers. GM agreed to pay $220 million and to obtain affirmative express consent before collecting or sharing driving and location data, without admitting the allegations.

## Key facts

- **Regulator or court:** Attorneys general of 35 states and the District of Columbia (Oregon and Washington co-lead)
- **Jurisdiction:** Washington, US
- **Framework:** State consumer protection laws (Oregon Unlawful Trade Practices Act in the Oregon judgment)
- **Record date:** 2026-10-29
- **Procedural status:** Stipulated judgments announced 29 October 2026; effective 30 November 2026; payment due within 30 days of that date

A dealership tick-box is not consent. Thirty-six attorneys general got $220 million from GM and a rule that driving data needs a separate, affirmative yes.

[Start a free scan](/run-free-codebase-scan)

- **Court**: Oregon Circuit Court, Multnomah County (Oregon judgment); similar judgments in the other jurisdictions
- **Case number**: Not shown on the copy reviewed
- **Parties**: State of Oregon ex rel. Attorney General Dan Rayfield and 35 other attorneys general v. General Motors LLC, General Motors Holdings LLC and OnStar, LLC
- **Laws**: State consumer protection laws; Oregon Unlawful Trade Practices Act (ORS 646.605 to 646.656)
- **Stage**: Stipulated general judgment; effective date 30 November 2026; no admission of facts or liability; appeal waived
- **Amount**: $220 million across participating states; $10,460,649 to Oregon
- **Source review**: 30 October 2026

## The problem

From 2015 GM offered Smart Driver as part of OnStar and promoted it as a way for drivers to improve their driving. The Oregon complaint alleges GM sold identifiable Smart Driver data to Verisk from 2015 and to LexisNexis Risk Solutions from 2019, which built driver reports sold to insurers, some of whom used them in setting rates. Most enrollment happened at the dealership in a single OnStar sign-up. GM paid dealership staff incentives tied to enrollment, and in many cases employees allegedly accepted the terms for customers. GM's apps told over 370,000 consumers they were not enrolled when they were ([Oregon complaint](https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-28-GM-Complaint-Final.pdf); [Oregon DOJ](https://www.doj.state.or.us/media-home/news-media-releases/ag-rayfield-leads-states-in-220m-settlement-w-gm-over-drivers-private-data/)).

## What the settlement requires

| Term | Requirement |
| --- | --- |
| Consent | Affirmative express consent before collecting or sharing covered driver data, with a separate consent where required; broad terms of use, or closing or muting content, do not count |
| Withdrawal | Consumers must be able to withhold or withdraw consent |
| Existing users | Notice to people enrolled in OnStar before the effective date; deletion of previously retained data unless consent is given |
| Dealers | Oversight and training so customers are not enrolled without consent |
| Program | Data minimization, a comprehensive privacy program, internal and third-party assessments |
| Money | $220 million within 30 days of the 30 November 2026 effective date, divided among the states |

Terms summarized from the [Oregon stipulated general judgment](https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-29-SGJ-Final-with-Exhibit-and-Cert.pdf) and [Oregon DOJ release](https://www.doj.state.or.us/media-home/news-media-releases/ag-rayfield-leads-states-in-220m-settlement-w-gm-over-drivers-private-data/). GM entered the judgment without admitting the allegations.

## Technical issue

- **Data:** trip start and end times, hard braking and acceleration, speeding and location (per the Oregon DOJ).
- **Recipients:** data brokers Verisk and LexisNexis, then insurers (alleged).
- **Consent state:** enrollment bundled into OnStar sign-up at the dealership, sometimes accepted by staff; app status screens wrong for over 370,000 people (alleged).

**Inth's technical interpretation:** consent has to be captured from the person whose data it is, for that purpose, and recorded. A bundled terms acceptance, or one entered by a salesperson, leaves no record that the consumer chose. Store purpose-level consent with who gave it and where, and make the status screen read the same record the data pipeline does.

Sample:

```ts
// Driving-data sharing enabled by the general terms acceptance at the dealership
if (account.acceptedTerms) shareDrivingData(broker);

// Separate, purpose-specific consent recorded from the driver
if (consent.has('driving-data-third-party', { subject: driver.id })) {
  shareDrivingData(broker);
}
```

## Timeline

| Date | Event |
| --- | --- |
| 2015 | Smart Driver launches; sales to Verisk begin (alleged) |
| 2019 | Contract with LexisNexis Risk Solutions (alleged) |
| April 2024 | GM announces it is discontinuing Smart Driver |
| 28 October 2026 | Oregon complaint dated |
| 29 October 2026 | 36 attorneys general announce the $220 million settlement |
| 30 November 2026 | Effective date of the judgment |
| By 30 December 2026 | Payment due (within 30 days of the effective date) |

## Outcome

GM agreed to stipulated judgments with 35 states and the District of Columbia. It will pay $220 million, including $10,460,649 to Oregon, and must meet consent, data-limitation, dealer-oversight and assessment terms ([Oregon judgment](https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-29-SGJ-Final-with-Exhibit-and-Cert.pdf)). New York says it receives more than $12 million ([New York AG](https://ag.ny.gov/press-release/2026/attorney-general-james-secures-220-million-general-motors-selling-drivers)). Montana is not on the coalition list and is suing GM separately ([Montana v. General Motors](/enforcement/montana-v-general-motors)).

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Total payment | $220 million | [Oregon judgment](https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-29-SGJ-Final-with-Exhibit-and-Cert.pdf) |
| Oregon share | $10,460,649 | [Oregon judgment](https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-29-SGJ-Final-with-Exhibit-and-Cert.pdf) |
| New York share | More than $12 million | [New York AG](https://ag.ny.gov/press-release/2026/attorney-general-james-secures-220-million-general-motors-selling-drivers) |

## Why it matters

- **Consent captured by a third party is fragile.** Dealer enrollment with staff accepting terms is central to the allegations.
- **Bundled terms do not count.** The judgment expressly excludes general terms acceptance from affirmative express consent.
- **Status screens are part of the record.** Telling users they were not enrolled when they were is pleaded as deception. Compare [General Motors (California)](/enforcement/general-motors) and [Montana v. General Motors](/enforcement/montana-v-general-motors).

## How Inth catches this

- **Consent banner**: Records purpose-level consent from the person using the product, with who, when, where and which notice, so a bundled acceptance is never mistaken for consent to sharing.
- **Website audit**: Checks websites for third-party requests before a choice and after a refusal. It does not see vehicle telematics or server-side broker feeds.

### Out of reach

- Inth cannot see data a company sells from its own servers or from connected vehicles, which is how this data moved.

Consent records per purpose with policy version and timestamp.

[Start a free scan](/run-free-codebase-scan)

## Checks for your own systems

Your ticks stay on this page. Inth does not save or send them.

### In the repository

- [ ] Find every flag that enables third-party data sharing and check whether it reads a purpose-specific consent or a general terms acceptance.
- [ ] Confirm the account status screen reads the same consent record the data pipeline uses.

### In the browser and network

- [ ] Walk the sign-up flow as a new user and record which consents are pre-ticked or bundled.
- [ ] Withdraw consent and confirm sharing stops.

### With the people responsible

- [ ] List partners, resellers or staff who can accept terms for a customer, and stop it for data-sharing consents.
- [ ] Inventory data brokers and insurers that receive customer data and the contract terms.

## Sources and limits

- [Oregon stipulated general judgment and money award](https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-29-SGJ-Final-with-Exhibit-and-Cert.pdf)
- [Oregon complaint](https://www.doj.state.or.us/wp-content/uploads/2026/10/2026-10-28-GM-Complaint-Final.pdf), dated 28 October 2026
- [Oregon DOJ press release](https://www.doj.state.or.us/media-home/news-media-releases/ag-rayfield-leads-states-in-220m-settlement-w-gm-over-drivers-private-data/), 29 October 2026
- [New York AG press release](https://ag.ny.gov/press-release/2026/attorney-general-james-secures-220-million-general-motors-selling-drivers), 29 October 2026

The Oregon judgment, Oregon complaint and both press releases were opened. The other 35 jurisdictions' judgments were not opened; the Oregon judgment says they are similar. The Oregon case number was not shown on the copy reviewed.

Source review: 30 October 2026. This page describes the cited record and procedural stage. It does not audit the company's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

## Related cases

[Every case in the Enforcement library](/enforcement)