GM Agrees to Pay $220 Million to 36 Jurisdictions Over Sale of Drivers' Data

GM Agrees to Pay $220 Million to 36 Jurisdictions Over Sale of Drivers' Data

General Motors agreed to pay $220 million to 35 states and the District of Columbia to resolve allegations that it sold drivers' behavior and location data to data brokers who resold it to insurers. The attorneys general announced the agreement on October 29, 2026. None of the money goes to drivers.

Information last verified on October 30, 2026. This is a developing story; we update it as the record changes.

Status: Agreed and announced October 29, 2026. This is not one national document: each jurisdiction filed its own judgment, and footnote 1 of both copies we read says the defendants are "simultaneously entering into similar judgments" and then lists all 36 jurisdictions, the signing state included. Both posted copies leave the judicial signature and its date blank: Washington's line reads "ORDERED AND ADJUDGED this [blank] day of [blank], 2026" and Oregon's reads "ORDERED AND ADJUDGED at PORTLAND, OREGON this [blank] day of [MONTH], 2026," with the blanks unfilled in the original. Oregon's filing travels with a Certificate of Readiness stating that the proposed judgment "is ready for judicial signature," so entry by a court is not confirmed. Oregon's party signature blocks are dated October 29, 2026; Washington's signature page carries no date. The Effective Date is November 30, 2026 (Oregon para 18; Washington para 17), and the $220 million is due no later than 30 days after that, which is about December 30, 2026 (Oregon para 72; Washington para 71). GM "do[es] not admit to any violation or liability arising from any state, federal, or local law" (Oregon para 76).

Jurisdiction scope: Footnote 1 of both the Oregon and Washington judgments names the same 36 jurisdictions: Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Hawaii, Idaho, Illinois, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington and Wisconsin. Washington and Oregon co-led, assisted by an executive committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont. Texas, Montana and California are absent from that list. One question these documents do not answer is whether the compliance duties reach drivers everywhere. Oregon's judgment defines "Consumer" as "a natural person in Oregon" (para 10) and "User" as a consumer with an OnStar account whose vehicle garage address is in Oregon (para 26); Washington's decree uses the identical definitions for Washington (paras 10 and 25). We read both judgments in full and could not establish nationwide reach from them. At least two of the other judgments are posted as well: Minnesota's filed Stipulated Judgment (Ramsey County District Court No. 62-CV-26-7734, court-stamped as filed October 29, 2026) and Pennsylvania's Consent Petition for Final Decree (Philadelphia Court of Common Pleas No. 261004104). Both carry the identical footnote 1, both scope "Consumer" to their own state's residents, and both likewise leave the judicial signature blank. The remaining judgments were not posted at the time of writing.

What Happened

Oregon's complaint, dated October 28, 2026 and brought in Multnomah County Circuit Court, sets out the state's allegations. GM admitted none of them, and the judgment expressly disclaims any concession of liability (Oregon judgment paras 76 and 77). Everything in this section is an allegation.

OnStar is GM's connected-vehicle service, sold with Chevrolet, GMC, Cadillac and Buick vehicles (complaint para 10). In 2015, according to the complaint, GM released "Smart Driver" as part of OnStar and promoted it as a tool to help people drive more safely (para 11). The attorneys general's press releases describe the program as running "from 2016 to 2024" and as enrolling "millions of drivers." The complaint's own date for the product's release is 2015, and the complaint says GM began selling OnStar and Smart Driver data to Verisk Analytics in 2015 (paras 11 and 13).

Two different data streams are alleged. The first is driver behavior: hard braking, hard acceleration, hard cornering, crossing a designated high-speed threshold, seat belt usage, late-night driving, and the trip time and duration for those events (para 11). The second is precise geolocation. Starting in 2018, the complaint alleges, a vehicle task collected and transmitted latitude and longitude along with elevation, heading, current speed, a timestamp and a trip identifier, "every three seconds from ignition on to ignition off," from millions of vehicles (paras 12 and 22). In 2019 that task also began collecting a persistent identifier that linked the location trail to a specific VIN (para 23).

The recipients are named in the complaint, where the press releases say only "data brokers." GM began selling to Verisk Analytics in 2015 and signed a similar contract with LexisNexis Risk Solutions in 2019; GM gave LexisNexis precise geolocation data, while Verisk's contract "expressly barred GM from providing such location data" (para 13). Both compiled consumer reports and driver ratings sold to insurance companies, some of which used them in part to set rates. Separately, GM licensed the geolocation data to the UK connected-car company Wejo Ltd in 2018; after Wejo's bankruptcy, its assets went to Jacobs Engineering Group on January 3, 2024, and Jacobs entered its own GM license the same day (paras 24 and 25). Wejo and later Jacobs could sublicense the data to GM-approved "egress licensees," which GM knew and approved but never identified to consumers (para 26). The complaint alleges GM "made over $20 million nationwide in connection with these data sales" (para 14).

The disclosure allegations are the core of the case. GM marketed Smart Driver as a way to "level up [their] driving skills" but "failed to disclose that it sold consumers' driving information to third parties" (para 16). Enrollment usually happened at the dealership, through screens where a consumer clicked "I accept" or "I decline" (para 17). Attempting to decline the OnStar terms produced a warning that doing so "will result in deactivation of all services, including Automatic Crash Response, Emergency Services, and Vehicle Diagnostics" (para 19). The state alleges that "[n]owhere in the enrollment process did GM disclose to consumers that GM would sell their data to third parties who would then sell it to insurance companies" (para 20), and that GM told customers its Insurance Discount Eligibility program would share only anonymous data while in fact selling identifiable data for every Smart Driver enrollee (paras 14 and 20).

Two further allegations stand out. A technical glitch caused GM's apps to tell "over 370,000 consumers that they were not enrolled in Smart Driver despite GM collecting and selling their driver data"; GM found the problem after an April 2024 New York Times article, never notified those consumers, and "quietly unenrolled" them (para 21). And GM paid dealership personnel incentives tied to OnStar enrollment and Smart Driver opt-ins, with the result that "[i]n many cases, dealership employees allegedly accepted terms and conditions on behalf of customers without their consent," while GM provided no training materials explaining what data was collected or how to obtain informed consent (paras 28 and 29).

The complaint says the New York Times reported on March 11, 2024 that GM was sharing consumer driver behavior data with insurance companies, and that GM announced in April 2024 that it was discontinuing Smart Driver "based on customer feedback" (para 15).

The attorneys general framed the outcome in their own terms. "People bought a car, not a tracking device," Oregon Attorney General Dan Rayfield said. Washington Attorney General Nick Brown said that "Washingtonians' data is personal and valuable, which is why they should always have control over how it's used." Pennsylvania Attorney General Dave Sunday called the conduct a "bait-and-switch tactic" that "betrayed consumers' trust and potentially impacted their insurance rates." The Oregon, Pennsylvania and Minnesota releases each state that the terms "are significantly stronger than any other resolution reached with GM for this conduct." That is the coalition's assessment of its own agreement, not ours, and the judgments do not compare themselves to the FTC order or the California judgment; the comparison below is limited to what each document says.

What the Settlement Requires GM to Do

The injunctive schedule is long, and most of it is dated off the November 30, 2026 Effective Date. Paragraph numbers below are Oregon's; Washington's text is the same but its paragraph numbers run one lower in several places, so the consent provision is Oregon's 42 and Washington's 41.

Consent, and what does not count as consent

The central obligation: "Defendants must obtain the relevant Consumer's Affirmative Express Consent prior to collecting or using such Consumer's Covered Driver Data, or disclosing such Consumer's Covered Driver Data to any Third Party" (para 42). "Affirmative Express Consent" is defined as a clear affirmative act signifying freely given, specific, informed and unambiguous agreement, following a clear and conspicuous disclosure (para 8).

What the judgment disqualifies matters as much as what it requires. Paragraph 8 lists four things that are not consent, including "[a]cceptance of general or broad terms of use or a similar document that contains descriptions of Covered Driver Data processing along with other, unrelated information" (8(b)); a user interface "that has the effect of subverting or impairing user autonomy, decision-making, or choice" (8(c)); and "[s]ilence, inactivity or inaction, pre-ticked boxes, and other negative option opt-out constructions that require intervention from the Consumer to prevent agreement" (8(d)).

Consent also cannot be bundled. "Each separate, unrelated service or feature that collects, uses, or discloses Covered Driver Data requires Defendants to obtain a separate Affirmative Express Consent" (42(a)), and each consent disclosure "must be separate from any 'privacy policy,' 'terms of service,' 'terms of use,' or other similar consumer-facing disclosure" (43(b)). Where GM discloses covered driver data to a third party for usage-based insurance, it must obtain consent and "disclose to Users that such data may be used for usage-based insurance rates or coverage" (43(c)). GM may not degrade a product's functionality as a penalty for withholding or withdrawing consent unless the data is technically necessary to deliver it (para 45).

Paragraph 42(b) carves out seven purposes that need no consent: disclosures to emergency responders; responses to a consumer-initiated communication; responses to a vehicle-initiated communication related to safe operation; lawful government requests and defense of product liability, contract, consumer protection or warranty claims; deidentified research and product development, excluding marketing; product quality and safety investigations, recalls, cybersecurity response and warranty administration; and diagnostics and prognostics.

Data minimization and assessments

GM "must limit collection of Covered Driver Data to what is adequate, relevant, and reasonably necessary to fulfill the specific purpose for which it was collected, as disclosed to the Consumer" (para 37), and must use, disclose or retain it only for purposes reasonably necessary to that purpose (para 38). The judgment classifies the sale of covered driver data "to the extent permitted by state law," and the disclosure of location data to third parties, as a "High-Risk Processing Activity" (para 19) that requires a documented Data Protection Assessment before GM engages in any new such activity (para 36). This is the structure readers most often misread: the sale of driving data is regulated and gated, not prohibited.

Deleting the old data

The legacy-data cutoff is January 16, 2025. Within 180 days of the Effective Date, GM must "[d]elete or destroy all Covered Driver Data retained prior to January 16, 2025," subject to listed exceptions such as litigation holds, legal process, diagnostics, deidentified research and safety investigations, and must give the Washington attorney general a written statement confirming the deletion (paras 63(a) and 63(b)). As an alternative, within 90 days of the Effective Date GM may email affected consumers asking for consent to keep that data, and must delete it where a consumer declines, does not respond within 30 days, or where the data has not been deidentified (para 64).

GM must also ask third parties that received covered driver data before January 16, 2025 to delete it, and must not sell or disclose data to a previous recipient until that recipient confirms receipt of the request. Where the recipient is a consumer reporting agency, GM needs written confirmation that the data was deleted or is subject to legal requirements preventing deletion (paras 56(a) and 56(b)).

That cutoff date is also the date the Federal Trade Commission announced its own proposed consent order against GM, General Motors Holdings and OnStar. The judgments do not say why January 16, 2025 was chosen, and we do not speculate beyond noting the match.

What GM must tell drivers, and when

Within 180 days of the Effective Date, GM must give users who enrolled in OnStar before that date a notice pointing them to the current consent disclosure, including how to withdraw consent and unenroll (para 44). A second, broader notice is tied to an open variable: within 30 days of the expiration of the litigation hold on covered driver data, GM must post a clear and conspicuous website notice that consumers may request deletion of their data and a copy of their data, leave it up for six months, and email that notice "to Consumers that were enrolled in OnStar at any time between January 1, 2018 through the Effective Date" (para 66). The judgments do not fix the litigation-hold expiration date, so the timing of the email that would reach the largest group of drivers is not set by the documents.

GM must also publish a privacy notice covering the categories of covered driver data collected, its sources, the specific purposes, any anticipated secondary purposes including usage-based insurance or targeted advertising where state law allows, retention periods, the categories of third parties including consumer reporting agencies, and how to exercise consumer rights (para 40). Within 180 days it must document an internal retention schedule (para 68) and publish a public one linked from its apps or website home page (para 69).

Enrollment, dealerships and the location toggle

Within 60 days of the Effective Date, GM must implement enrollment "by independent Consumer action, such as via email," and "any Consumer who does not act within ten (10) days of the Enrollment Notice will be treated as declining enrollment in OnStar" (para 49). It must sample enrollments for anomalous patterns that may indicate dealer noncompliance. Also within 60 days, GM must develop dealer training materials instructing dealership personnel that consumers be given the opportunity to review the privacy disclosures and "must accept those disclosures themselves prior to enrollment in OnStar" (para 57). A consumer who declines or unenrolls may disable GM's remote collection of all data from the vehicle, subject to narrow safety and over-the-air-update exceptions (para 48).

Separately, GM must allow consumers to disable location data collection where the vehicle has the technology, which "may be accomplished by providing a mechanism such as a toggle on the Vehicle" (para 46), and must disclose that option and where to find the instructions at or before the consent request and in the privacy notice (para 47).

Program, oversight and how long it lasts

Within 180 days GM must implement a comprehensive information privacy program (para 32) under a Chief Privacy Officer who reports at least annually to the board or a board committee (para 33). Within 90 days it must engage an independent Third-Party Assessor to assess that program (para 58); the first assessment covers the 365 days after the Effective Date, then biennial assessments for four more years (para 59), and GM must give each report to the Washington attorney general within 30 days of receipt (para 60), which Washington may share with the other plaintiff states on request (para 61). GM must keep specified records, including records of each consumer's consent and of every deletion and copy request, for at least five years (para 71).

Durations split. The privacy-program obligations, the deletion and copy methods, and the retention schedules "continue until January 13, 2046" (paras 32, 62, 65, 68, 69). Paragraphs 36, 39, 47 and 52 through 55, which cover data protection assessments, the OnStar data inventory, the location-disclosure requirement and the vendor due-diligence and contracting rules, expire ten years after the Effective Date, around November 30, 2036 (para 32). Note that the location-disabling right itself (para 46) is not on that ten-year expiry list; the obligation to tell drivers about it (para 47) is.

Is There a Payment for Drivers?

No. There is no claims process, no claim form, no claims administrator, and no individual payment to drivers from this settlement. If you own or owned a GM vehicle with OnStar, there is nothing here for you to file, and no one is owed a check because of these judgments. Any website that invites you to "file a claim" for the GM $220 million settlement is not describing these documents.

The $220 million is divided among the participating states and paid directly to each plaintiff (Oregon para 72). Oregon's $10,460,649 "may be used for purposes that may include, but are not limited to, attorneys' fees, and other costs of investigation and litigation, or be placed in, or applied to, any consumer protection law enforcement fund, including future consumer protection or privacy enforcement, consumer education, litigation or local consumer aid fund or revolving fund... or for any other lawful purpose, at the sole discretion of Plaintiff" (para 73). Washington's $12,311,819 carries the same structure: costs and fees, future monitoring and enforcement, and any lawful purpose at the attorney general's discretion (Washington para 72). Pennsylvania's office says it expects $8.67 million; Minnesota's says it will receive $7,095,664.

What drivers do get is a set of rights they have to exercise themselves:

• A deletion request. GM must provide "an easily-located method" to request deletion of your covered driver data, usable at any time and requiring a minimal number of steps, with confirmation of receipt (para 62). If you live in a state whose law gives you deletion rights, GM must process the request under that law; if not, GM must process it within 60 days of verifying you (paras 62(a) and 62(b)). This obligation runs until January 13, 2046.
• A copy of your data, and who got it. GM must provide an easily accessible method to request a copy of your covered driver data "and a list of the categories of Third Parties with whom Defendants shared any Covered Driver Data," processed within 45 days, subject to legal and regulatory exceptions (para 65). Also until January 13, 2046.
• Notice that these options exist. The website notice and the email to everyone enrolled in OnStar between January 1, 2018 and the Effective Date (para 66), on the litigation-hold timing described above.
• The ability to decline or unenroll, and to shut collection off. Declining or unenrolling from OnStar lets you disable GM's remote collection of all data from the vehicle (para 48), and the location toggle is separate from that (para 46).
• A complaint route through your state. GM must maintain a point of contact for consumer protection agencies and "promptly review and respond to all User complaints submitted by a Consumer Protection Agency" (para 67). The path runs through your attorney general, not through a settlement administrator.

Private claims are a separate track that these judgments neither create nor foreclose. Oregon paragraph 74 provides that nothing in the judgment shall be construed to "create, waive, or limit any private right of action." GM's Form 10-Q for the quarter ended September 30, 2026 states that putative class actions over OnStar Smart Driver data are pending in US federal courts and were consolidated in June 2024 into a multidistrict litigation in the Northern District of Georgia, and that GM had accrued $0.5 billion for these investigations and litigations. That MDL is not this settlement, and nothing in these judgments distributes money to consumers.

What the Law Actually Says

Oregon brought one count, under the Oregon Unlawful Trade Practices Act, ORS 646.605 to 646.656. The count pleads three provisions: ORS 646.607(12), which makes it unlawful to publish a business website statement about how the business will use, disclose, collect, maintain, delete or dispose of consumer information and then handle that information "in a manner that is materially inconsistent" with the statement; ORS 646.608(1)(e), representing that services have characteristics or benefits they do not have; and ORS 646.608(1)(g), representing that services are of a particular standard or quality when they are of another (complaint para 31). ORS 646.608(2) provides that an actionable misrepresentation "may be any manifestation of any assertion by words or conduct, including, but not limited to, a failure to disclose a fact" (complaint para 32). Oregon's prayer sought penalties of up to $25,000 per violation under ORS 646.642(3); the judgment awards a fixed sum instead, with $0 in attorney fees and $281 in filing costs.

The Oregon attorney general's office explains the statutory choice directly: much of the alleged conduct happened before the Oregon Consumer Privacy Act took effect on July 1, 2024, and its release notes that the OCPA "bans the sale of the precise geolocation data of Oregon consumers by all covered entities, not just GM." Washington proceeded under its Consumer Protection Act, RCW 19.86.010 et seq., with the attorney general's enforcement authority under RCW 19.86.080.

Each judgment carries an Exhibit A listing all 36 jurisdictions' consumer protection statutes and, where one exists, the comprehensive consumer privacy act. In Oregon's exhibit, eleven jurisdictions have an entry in the privacy column: the Colorado Privacy Act, C.R.S. 6-1-1301 et seq.; Connecticut's data privacy chapter, Conn. Gen. Stat. 42-515 et seq.; the Delaware Personal Data Privacy Act, 6 Del. C. 12D-101 et seq.; the Kentucky Consumer Data Protection Act, KRS 367.3611 et seq. (effective January 1, 2026); the Maryland Online Data Privacy Act, Md. Code Ann., Com. Law 14-4701 et seq.; the Minnesota Consumer Data Privacy Act, Minn. Stat. 325M.10 to 325M.21 (effective July 31, 2025); N.H. Rev. Stat. Ann. 507-H:1 et seq. (effective January 1, 2025); N.J.S.A. 56:8-166.4 to 56:8-166.19 (effective January 15, 2025); the Oregon Consumer Privacy Act, ORS 646A.570 to 646A.589 (effective July 1, 2024); the Utah Consumer Privacy Act, Utah Code 13-61-101 et seq.; and Virginia's Consumer Data Protection Act, Virginia Code 59.1-575 to 59.1-584. Washington's own Exhibit A adds one more, the Florida Digital Bill of Rights, Chapter 501, Part V, Fla. Stat. 501.715, which Oregon's exhibit leaves blank for Florida. Small as it is, that difference is a reminder that these are 36 separately drafted instruments, not one text. If you are comparing what your own state's privacy act gives you, start with our side-by-side of how the state comprehensive privacy acts differ and the broader US data privacy law hub.

No federal statute is cited in either judgment. In particular, the federal Driver Privacy Act of 2015 appears nowhere in the documents we read, and it should not be attributed to this settlement.

The other GM driver-data proceedings

Several jurisdictions absent from footnote 1 have their own matters, and none of them is resolved by these judgments. Fifteen states are absent from the 36 in all, and besides the three below, Arkansas, Nebraska and Iowa have each sued GM and OnStar over driver data: Arkansas on February 26, 2025 under the Arkansas Deceptive Trade Practices Act, Nebraska on July 8, 2025 in Lancaster County District Court under the Nebraska Consumer Protection Act and Uniform Deceptive Trade Practices Act, and Iowa on February 26, 2026 in Polk County District Court under the Iowa Consumer Fraud Act, seeking restitution, civil penalties and an injunction.

The Federal Trade Commission announced a proposed consent order against General Motors LLC, General Motors Holdings LLC and OnStar, LLC on January 16, 2025, and finalized it on January 14, 2026 (File No. 242-3052, Docket No. C-4828). The final order imposes a five-year prohibition on disclosing covered driver data to any person acting as a consumer reporting agency, requires affirmative express consent before collecting, using or disclosing covered driver data, and runs 20 years. Its consent provision reaches "the relevant U.S. consumer's" data, which is broader on its face than the state-resident definitions in the Oregon and Washington judgments.

California is not a party to these judgments. Attorney General Rob Bonta, joined by four county district attorneys and with support from the California Privacy Protection Agency, announced a separate settlement on May 8, 2026, subject to court approval, requiring GM to pay $12.75 million in civil penalties, to stop selling driving data to consumer reporting agencies including LexisNexis and Verisk for five years, to delete retained driving data within 180 days absent affirmative express consent, and to ask those two companies to delete data, under the California Consumer Privacy Act and the Unfair Competition Law.

Montana is also absent. The Montana Department of Justice announced on October 16, 2026, thirteen days before this settlement, that Attorney General Austin Knudsen sued GM and OnStar in Lewis and Clark County under Montana's Unfair Trade Practices and Consumer Protection Act, seeking a permanent injunction, civil fines and deletion of driving data including data held by third parties. Texas sued GM on August 13, 2024 over the driving data of more than 1.5 million Texans. We found nothing in any document we opened stating how either matter now stands; these judgments do not resolve them, and GM's September 30, 2026 Form 10-Q says only that "several states have filed enforcement lawsuits against us."

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The money is the headline and the consent architecture is the substance. Paragraph 8's list of non-consent is the part of this document that will be quoted in other cases, because it rules out the three mechanisms that most connected-product onboarding actually uses: a bundled terms-of-use acceptance, a pre-ticked box, and an opt-out default. Paragraph 42(a) adds unbundling, so one acceptance cannot cover a safety service and a data-sale feature at once. Paragraph 43(b) forces the disclosure out of the privacy policy and into its own surface. Taken together those are design requirements, and they are more specific than the text of most of the state privacy acts listed in Exhibit A.

The limits are equally real. Nothing here prohibits selling driving data. Sale is treated as a "High-Risk Processing Activity" (para 19) that triggers a pre-launch assessment (para 36), expressly "to the extent permitted by state law." The five-year prohibition on disclosures to consumer reporting agencies lives in the FTC order and the California judgment, not in these judgments. So a reader who concludes from the press coverage that GM can no longer sell driving behavior to the insurance data chain is reading the FTC order's clock, which started in January 2026, onto a document that does not contain it.

Two things in the schedule deserve watching rather than celebrating. The notice most likely to reach ordinary drivers, the email to everyone enrolled in OnStar from January 1, 2018 through the Effective Date (para 66), is keyed to the expiration of a litigation hold that no document we read dates. And the assessment regime reports to the Washington attorney general (para 60), with other states receiving reports on request (para 61), which concentrates the monitoring workload in one office.

The scope question is the one we cannot close. Both judgments define "Consumer" by state residency (Oregon para 10; Washington para 10). Yet Oregon paragraph 62(b) contemplates processing a deletion request from a consumer who "does not reside in a U.S. jurisdiction that provides the Consumer with Deletion rights," which reads like national template language carried into a state-scoped instrument. A compliance program that must satisfy 36 judgments plus a 20-year federal order will in practice tend toward one national implementation, and the FTC order's "U.S. consumer" phrasing points the same way. That is a prediction about engineering, not a legal conclusion, and we are not making it as one. On the four corners of the two judgments available, the duties are owed with respect to that state's residents.

Finally, the enforcement route is worth naming. These are state consumer protection cases, not privacy-act cases, in a state that has a privacy act. Oregon's own release makes the point that its 1970s-era unlawful trade practices statute did the work because the conduct predates the OCPA. For anyone tracking where connected-vehicle and data broker enforcement will come from next, that is the operative lesson: the deception theory reaches backward, and the privacy acts reach forward.

How This Affects You

If you drive, or drove, a Chevrolet, GMC, Cadillac or Buick with OnStar in one of the 36 jurisdictions, the practical effect of this agreement is procedural, it depends on you acting, and it starts on November 30, 2026. Whether these duties reach drivers in the other states is the open question described above. The deletion request and the data copy described above are the two things to use, and both are written to last until January 13, 2046. Watch for a notice on GM's website, and for an email if you were an OnStar enrollee at any point from January 1, 2018 onward, remembering that the timing of that email is tied to an undated litigation hold.

Stopping collection is a different question from deleting what GM already holds, and the controls are separate. Declining enrollment or unenrolling from OnStar lets you disable remote collection of all data from the vehicle, with narrow exceptions for consumer-initiated contact, safety-related vehicle messages, safety fixes and over-the-air updates (para 48). Disabling location data collection is its own control, where the vehicle has the technology (para 46). The privacy notice (para 40) and the public retention schedule GM must publish within 180 days (para 69) are where you can see what is still collected and how long it is kept.

If you believe your insurance premium moved because of data sold in this period, these judgments give you no remedy. They do not create a private right of action, and they do not waive one (para 74). Rate disputes run through your state insurance regulator, and anything beyond that is a question for a licensed attorney in your state. If your concern is the wider resale market rather than GM specifically, start with the mechanics of removing your information from data brokers, and note that vehicle location data sits in the same legal neighborhood as the rules we track under GPS tracking laws by state.

This is general legal information, not legal advice. It describes what two of the 36 judgments in this matter say, as posted by the Oregon and Washington attorneys general and read on October 30, 2026. It does not tell you what your own rights are, and reading it creates no attorney-client relationship. Settlement terms, effective dates and enforcement positions change. For advice about your own vehicle, your own data or your own insurance rates, consult a licensed attorney in your state.

Related articles

• How the state comprehensive privacy acts compare
• Data broker registration laws, state by state
• Montana's data privacy law
• Automated license plate readers and location surveillance

---

Last updated: 2026-10-30. This is a developing story; details verified as of 2026-10-30.

Frequently Asked Questions

Do I get money from the GM $220 million settlement?

No. There is no claims process, no claim form and no individual payment. The $220,000,000 is divided among the 36 participating jurisdictions and paid directly to each state plaintiff, no later than 30 days after the November 30, 2026 Effective Date (Oregon judgment para 72). Oregon's $10,460,649 may be used for attorneys' fees, investigation and litigation costs, consumer protection enforcement funds, consumer education or 'any other lawful purpose, at the sole discretion of Plaintiff' (Oregon para 73). Any site inviting you to file a claim for this settlement is not describing these documents.

Does this settlement ban GM from selling driving data?

No. It requires consent first. GM 'must obtain the relevant Consumer's Affirmative Express Consent prior to collecting or using such Consumer's Covered Driver Data, or disclosing such Consumer's Covered Driver Data to any Third Party' (Oregon para 42), with exceptions listed in paragraph 42(b). Sale is treated as a 'High-Risk Processing Activity' needing a pre-launch Data Protection Assessment (Oregon paras 19 and 36), and the definition says 'to the extent permitted by state law.' The separate FTC order finalized January 14, 2026 is what imposes a five-year prohibition on disclosures to consumer reporting agencies.

What counts as consent under these judgments?

A clear affirmative act signifying freely given, specific, informed and unambiguous agreement, after a clear and conspicuous disclosure (Oregon para 8). Paragraph 8 also states what does not count, including 'Acceptance of general or broad terms of use or a similar document that contains descriptions of Covered Driver Data processing along with other, unrelated information' and 'Silence, inactivity or inaction, pre-ticked boxes, and other negative option opt-out constructions.' Each separate, unrelated feature needs its own consent (para 42(a)), and the disclosure must sit outside the privacy policy and terms of service (para 43(b)).

Has a judge entered this judgment yet?

Not as far as the posted copies show. Both leave the judicial signature and its date blank: Washington's line reads 'ORDERED AND ADJUDGED this [blank] day of [blank], 2026,' and Oregon's reads 'ORDERED AND ADJUDGED at PORTLAND, OREGON this [blank] day of [MONTH], 2026,' with the blanks unfilled in the original. Oregon's is accompanied by a Certificate of Readiness stating the proposed judgment 'is ready for judicial signature.' Oregon's party signatures are dated October 29, 2026, and Washington's signature page is undated. Washington's decree carries King County Superior Court No. 26-2-35496-1 SEA; the case-number line on Oregon's posted copy is blank. The Effective Date is November 30, 2026 regardless (Oregon para 18; Washington para 17).

I live in Texas, Montana or California. Am I covered?

Those three are not among the 36 jurisdictions in footnote 1, and each has its own proceeding: California announced a separate $12.75 million settlement on May 8, 2026; Montana announced a suit in Lewis and Clark County on October 16, 2026; Texas sued in August 2024. On the scope of these judgments, we could not establish nationwide reach. Oregon defines 'Consumer' as 'a natural person in Oregon' (para 10) and Washington defines it as a natural person in Washington (para 10). The separate FTC order's consent provision reaches 'the relevant U.S. consumer's' data, which is broader on its face.

How do I ask GM to delete my driving data or send me a copy?

GM must provide an easily located deletion method and an easily accessible method to request a copy of your covered driver data plus the categories of third parties that received it (Oregon paras 62 and 65). Both must be usable at any time, described clearly, and take a minimal number of steps, and GM must confirm receipt. Where your state's law gives deletion rights, GM must follow that law; otherwise it has 60 days to process deletion and 45 days to provide a copy. Both obligations run until January 13, 2046.

Which data was allegedly collected and sold?

Oregon's complaint alleges two streams. Driver behavior: hard braking, hard acceleration, hard cornering, crossing a designated high-speed threshold, seat belt usage, late-night driving, and trip time and duration for those events (para 11). And precise geolocation: latitude, longitude, elevation, heading, speed, timestamp and a trip identifier, collected 'every three seconds from ignition on to ignition off' and from 2019 linked to a persistent vehicle identifier (paras 12, 22 and 23). The complaint names Verisk Analytics and LexisNexis Risk Solutions as purchasers, and Wejo Ltd and later Jacobs Engineering Group as geolocation licensees. GM admits none of this (judgment paras 76 and 77).