GM to pay $220 million to US states over sale of drivers' data

General Motors (GM), the US carmaker, has agreed to pay $220 million to settle claims by a coalition of US states that it sold drivers' driving and location data to data brokers, who passed it on to insurance companies, the states announced on Thursday, October 29, 2026. The coalition, co-led by Oregon and Washington, includes about three dozen states; one tally puts it at 35 states plus the District of Columbia. GM did not admit wrongdoing. Under the settlement, the company must get drivers' clear, affirmative consent before collecting or sharing their driving data, and must submit to outside checks of its privacy programme.

Modern cars are computers on wheels. Many are permanently connected to the internet so that they can offer navigation, emergency calls, remote locking and app controls. That connection also lets carmakers record where a car goes, how fast it travels and how hard it brakes. This data is valuable: insurers can use it to judge how risky a driver is, and that can raise or lower premiums. The case against GM was that drivers did not knowingly agree to have this information sold, and some were told they were not enrolled when they were.

The settlement matters well beyond one company. It sets out, in practical terms, what regulators expect from any business that collects data from devices people use every day: ask clearly, collect only what is needed, and let independent auditors check. Terms like "affirmative express consent" mean the customer must actively say yes, rather than having agreement buried in a long sign-up form. For technology start-ups building connected products, from car software to fitness trackers and smart-home devices, the case is a warning that data-sharing deals can bring large penalties years later.

There is a clear lesson for India too. India's Digital Personal Data Protection (DPDP) Act, 2023, and its rules, notified on November 13, 2025, are coming into force in stages. A rule on consent managers, regulated platforms through which people can give, track and withdraw consent, is due to take effect on November 13, 2026. As more cars sold in India come with built-in connectivity, Indian carmakers, insurers and start-ups using vehicle data will face the same basic question the GM case raises: did the driver really agree?

Short-term: GM pays $220 million and must change how it handles driver data, while the participating states receive funds and gain oversight through third-party assessments.

Long-term: The terms are likely to shape how carmakers and other connected-device companies design consent and data-sharing, and they give regulators elsewhere, including in India, a model for what clear consent should look like.

Who is affected: GM owners in the participating US states, car insurers and data brokers that bought driving data, connected-car and device start-ups, and privacy regulators in the US and other countries.

Questions and Answers