On October 29, 2026, New York Attorney General Letitia James and a bipartisan coalition of 35 other state attorneys general settled with General Motors for USD 220 million, including USD 12,054,341 for New York, over the sale of identifiable driving and location data from the Smart Driver program to data brokers for insurance products. The New York Attorney General release states that GM told drivers it would not share their data with insurers without express consent, then sold that data under contracts that specified insurance-product use.
Connected-vehicle manufacturers selling into New York and the other coalition states, franchised auto dealers that enroll buyers in connected-vehicle and driving-score programs, data brokers that package identifiable driving and location data for insurance products, and auto insurers that buy driving-behavior scores to set premiums must immediately review dealer enrollment and any contract that sells identifiable driving or location data to brokers or insurers, and obtain express consent before that collection or disclosure, or face a multi-state attorney-general settlement of the kind imposed on General Motors: a payment to the states (USD 220 million in this case) plus binding limits on driving-data collection, internal and third-party privacy assessments, and dealership training.
- Authority : New York Attorney General Letitia James, with 35 other state attorneys general
- Entity : General Motors
- Measure and amount : settlement of USD 220 million, of which USD 12,054,341 goes to New York
- Legal basis : sale of Smart Driver data to brokers for insurance use, against GM's express-consent statement (no statute section cited)
- Decision date : October 29, 2026
- Official source : New York Attorney General, October 29, 2026
What happened
From 2016 to 2024 GM enrolled millions of drivers in Smart Driver, more than 700,000 of them in New York, recording each trip, hard braking, hard acceleration and speeding. In many cases, dealership employees allegedly accepted terms and conditions on behalf of customers without their consent, and from 2020 to 2024 bonuses depended in part on sign-ups. The OnStar app told more than 370,000 drivers they were not enrolled while the data was sold. GM later unenrolled them without notice and left the data with the brokers.
The breach
The release cites no statute section. GM told drivers it would not share data with insurers without express consent, then sold trip reports to brokers under contracts written for insurance products. Attorney General James stated: "General Motors collected data on their customers' personal driving habits without their knowledge and then sold it, potentially affecting their insurance rates." One owner's 22 percent premium rise was tied to a 130-page report of six months of trips.
Who else is in the same regime
General Motors is the sanctioned company. The same exposure covers connected-vehicle manufacturers selling into the coalition states, franchised dealers that enroll buyers, data brokers of identifiable driving data, and auto insurers that buy driving scores.
What to check now
- Have the buyer, not dealership staff, accept any connected-vehicle or driving-score enrollment.
- Drop dealer bonuses that pay for sign-ups without the buyer's own consent.
- Stop any sale of identifiable driving or location data to a broker or insurer without express consent for insurance use.
- Correct app notices that say a driver is unenrolled while collection continues, and do not leave that data with brokers after an unenrollment.
- Keep trip reports out of premium setting without that consent, and run in-house and third-party privacy assessments plus dealer training.
