GM Will Pay $220 Million Over Driving Data. Here's What Owners Can Do Now

If you drive a Chevrolet, Buick, GMC or Cadillac with OnStar, you may be wondering whether your braking, speed and trip times ended up in an insurance file. On Thursday, General Motors agreed to pay $220 million to settle claims from 36 attorneys general, from 35 states and the District of Columbia, that it sold that kind of driver data to data brokers, and that insurers then bought it from them.

GM did not admit wrongdoing. The consent decree states that GM does not admit any violation or liability, and that nothing in it counts as a concession. In an emailed statement, GM said: "This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices."

The case is about Smart Driver, an OnStar feature that GM pitched as a way to drive more safely. The states' complaint alleges GM collected hard braking, hard acceleration, hard cornering, high speeds, late-night driving, seat belt use and trip time, plus precise location tied to names, addresses and vehicle identification numbers. It alleges GM sold Smart Driver data to Verisk Analytics starting in 2015 and to LexisNexis Risk Solutions from 2019, that both turned it into reports and driver ratings for insurers, and that some insurers used that information in part to set rates. The complaint also alleges GM sold data for every Smart Driver customer, including people who did not join a separate insurance discount program.

What this means for you

You don't need to file anything. The $220 million goes to the states, and Washington's share is $12,311,819. The Washington decree sets up no claim form and no payments to drivers, and the state announcements don't mention either. Treat any message that offers to help you claim a share as suspect until an attorney general's own site backs it up.

What you get is more control, starting on the decree's effective date of Nov. 30, 2026. From then on, GM must get a driver's express consent before it collects or uses driving or location data, or hands it to an outside company. The exceptions include sending data to emergency responders, safety recalls, warranty work and legal requests. GM must let drivers turn off location collection on vehicles that support it, and unenrolling from OnStar must switch off GM's remote data collection. Dealership staff must be trained so buyers review the privacy terms and accept them themselves before they are enrolled.

The decree also covers old data. GM must ask the companies it gave data to before Jan. 16, 2025 to delete it, delete its own copies from before that date within 180 days of the effective date unless a driver agrees to let it keep them or a limited exception applies, and give drivers a way to ask for a copy of their data and for deletion. Several of these duties run until Jan. 13, 2046.

One caveat. We read Washington's decree, which defines a covered driver as a person in Washington. The other 35 are described as similar judgments, so the details in your state may differ. Texas is not on the list and sued GM on its own in August 2024. California reached its own $12.75 million deal with GM in May.

The FTC has its own order against GM and OnStar, announced as a proposed deal in January 2025 and finalized in January 2026. It bans GM from giving driver data to consumer reporting agencies for five years, and for 20 years it requires GM to offer every US consumer a way to ask for a copy of their data and for deletion.

What to do next

Start with what GM holds. Send GM's U.S. Consumer Privacy Request Form an access request, or call 1-866-697-7482. GM does not take these by email and can take up to 45 days. It will also list the vehicles it ties to you and the kinds of data it collected, which can include driving behavior and location. That tells you what exists before you decide what to switch off.

Then check with the two companies named in the complaint, Verisk and LexisNexis. The settlement papers we read don't name them.

Asking a data company for your file. Illustration: Tech Cheat Codes

For Verisk, fill out the Driving Behavior Data History Report form on its page, then email it to FCRA-NPC@verisk.com, fax it to 800-955-2422, or mail it to Verisk Underwriting Solutions Consumer Inquiry Center, P.O. Box 5404, Mt. Laurel, NJ 08054. Verisk gives one free report in any 12-month period, and its report covers GM data up to Mar. 18, 2024. For LexisNexis, use the online request form, call 1-866-897-8126, or mail its printable form to the LexisNexis Risk Solutions Consumer Center, P.O. Box 105108, Atlanta, GA 30348-5108. It may ask for your Social Security number or driver's license number to confirm who you are, and it mails you a letter with instructions to open the report online. The LexisNexis page doesn't say whether driving data appears in the Consumer Disclosure Report, so scan yours for trip entries.

If an insurer raised your rate or turned you down, look at the letter for the name of a reporting company. Verisk lists 1-800-709-8842 for a copy of a report tied to a notice like that.

Next, limit what your car shares. In the vehicle, open Privacy Settings on the infotainment screen. Some model year 2019 and later vehicles have an option there to turn off OnStar location services, though GM can still locate the vehicle in an emergency such as a crash. We found no published menu path for the myChevrolet, myBuick, myGMC or myCadillac apps, so use the car's screen and your owner's manual for exact menu names. In your GM account, GM points to a Data and Privacy section. We couldn't open that page without signing in, and GM's pages describe it for exterior camera consent, so check what else it offers once you're in.

A location switch on a car screen. Illustration: Tech Cheat Codes

To cut the connection entirely, call OnStar at 1-888-466-7827 or press the blue button in the car. Unenrolling removes the vehicle from all connected services, so decide first whether you can do without OnStar's crash response and navigation. GM may still collect location when you press the blue button, and on electric vehicles if the high-voltage battery overheats.

Send the GM access request first, since it shows you what to ask for at Verisk and LexisNexis.

References