An ordinary drive to work should not come with an unexpected consequence: personal driving information ending up in an insurance company’s files without the driver’s knowledge.
Yet that is the controversy surrounding General Motors after an investigation found that sensitive driving and location data collected through its former Smart Driver program was sold to data brokers and subsequently provided to insurance companies.
On October 29, 2026, GM agreed to a US$220 million settlement with a coalition of American attorneys general, alongside new requirements designed to protect driver information.
While the settlement addresses American allegations, it raises important questions for Canadian Chevrolet, GMC, Buick, and Cadillac owners about connected-vehicle technology, meaningful consent, and who ultimately controls the information their vehicles collect.
A $220 Million Settlement That Goes Beyond Financial Penalties
The agreement announced on October 29 brings together 36 American attorneys general representing 35 states and the District of Columbia. Oregon and Washington co-led the case, which accused General Motors of improperly collecting and selling consumers’ driving behaviour and location information. Under the settlement, GM will pay US$220 million to the participating jurisdictions. Washington is receiving approximately $12.3 million, New York just over $12 million, and Michigan about $7.2 million. The amount reflects the seriousness of the allegations and the scale of the investigation into data practices that continued for years. The participating governments also secured commitments intended to prevent similar conduct.
An important distinction is that the money is not being distributed automatically to affected drivers. Michigan’s attorney general confirmed that the agreement does not provide individual consumer restitution, although a separate nationwide private class-action lawsuit seeking monetary relief remains pending. The settlement also does not establish that every participating driver experienced an insurance increase or that every GM vehicle was affected. Its broader significance lies in the combination of financial penalties and restrictions on future data collection. For automakers increasingly dependent on connected services, the agreement demonstrates that consumer information can create significant legal exposure when privacy protections fail to keep pace with technology.
The Smart Driver Feature That Collected Detailed Driving Habits
At the centre of the controversy was OnStar Smart Driver, a feature GM introduced in 2016 to help motorists understand and potentially improve their driving habits. The program gathered information such as trip frequency, journey start and end times, rapid acceleration, hard braking, and speeding events. By presenting this information as driving feedback, Smart Driver offered something that sounded relatively harmless: an opportunity to recognize potentially risky habits. Millions of drivers participated before the program was discontinued in 2024. However, the information being collected was considerably more detailed than a simple safety score, allowing patterns of everyday vehicle use to be reconstructed over extended periods.
The distinction between useful driving feedback and sensitive personal information became central to the investigation. A record of sudden braking might reflect aggressive driving, but it could also result from avoiding an animal, responding to another motorist, or stopping quickly at a busy intersection. Similarly, information about when a vehicle moves can reveal commuting routines and other personal habits. Regulators alleged that GM presented Smart Driver as a self-improvement tool while failing to adequately explain how information would reach outside companies. GM announced in April 2024 that it would discontinue the feature, saying customer feedback had prompted a review of its privacy practices. The decision ended the program, but it did not eliminate questions about information already collected and distributed.
How Driving Information Reached Insurance Companies
The investigation identified a commercial arrangement that moved information from GM vehicles to data brokers and then into the insurance industry. Companies including LexisNexis Risk Solutions and Verisk received driving information through agreements with GM. Regulators found that these arrangements were designed to support insurance-related products, allowing insurers to purchase information or assessments derived from individual driving records. California investigators also established that certain information sold to LexisNexis included precise location details. The data could be associated with identifiable consumers rather than being limited to anonymous, aggregated statistics. That made it potentially valuable for insurance underwriting, where companies attempt to estimate the likelihood of future claims.
For drivers, the concerning element was how easily routine vehicle activity could become a commercial assessment. Accelerating onto a highway, braking suddenly in traffic, or taking frequent trips could contribute to a profile used by insurers. The U.S. Federal Trade Commission found that information collected through Smart Driver could reach consumer reporting agencies, which compiled reports used in insurance decisions. Drivers were not necessarily communicating directly with those agencies or knowingly participating in an insurance-monitoring program. The controversy therefore extends beyond whether information was collected legally. It also concerns whether consumers could reasonably understand that a feature offered by their vehicle manufacturer might influence how another business evaluated their financial risk.
One Chevrolet Bolt Owner Discovered Hundreds of Recorded Trips
The financial consequences became particularly visible through the experience of Kenn Dahl, a Chevrolet Bolt driver near Seattle whose story was documented by The New York Times in March 2024. Dahl had not been responsible for an accident, yet his car insurance costs increased by 21% in 2022. An insurance agent subsequently identified his LexisNexis report as a factor affecting the quotes he received. When Dahl requested the report, he discovered a 258-page document containing more than 130 pages of detailed driving records. Those records covered 640 trips taken by him or his wife over approximately six months, including journey times, distances, and acceleration or braking events.
The discovery illustrated why driving information could carry financial consequences even when a vehicle owner had never filed an insurance claim. Insurers can consider predictive information alongside more traditional factors when assessing risk, and the information may not always capture the circumstances behind individual driving events. A hard-braking incident could reflect dangerous behaviour or an appropriate response to danger. Dahl’s experience does not prove that every dollar of his increase resulted from GM’s information, but it demonstrates how unexpected reporting can complicate insurance decisions. For motorists already facing substantial ownership expenses, learning that routine driving information has influenced their insurance quotes introduces an entirely different concern about connected-vehicle ownership.
Dealership Enrolment Became a Major Part of the Investigation
One of the most troubling findings involved the way consumers were enrolled in Smart Driver. According to the attorneys general, many customers joined the program while purchasing their vehicles at GM dealerships, where Smart Driver enrolment was combined with registration for other OnStar services. Investigators alleged that dealership employees sometimes accepted terms and conditions on behalf of customers without obtaining their permission. Between 2020 and 2024, GM also offered incentives linked to connected-service enrolment. Dealership employees could receive bonuses based partly on customer registrations, while dealerships were ranked according to their enrolment performance. Those arrangements created concerns that increasing participation sometimes received greater attention than ensuring customers understood the agreement.
The problem was particularly significant because OnStar included services unrelated to driver scoring, such as assistance, navigation, and vehicle security features. Someone interested in emergency assistance might not expect registration to include a separate program that generated data for insurance-related products. The FTC described GM’s enrolment process as confusing and misleading, with some customers unaware they had activated Smart Driver. That raises an important distinction between accepting a general technology agreement and knowingly authorizing a specific use of sensitive information. The settlement responds to this concern by requiring stronger dealership oversight and training. It also highlights why transparency cannot depend entirely on lengthy electronic agreements presented during an already complicated vehicle purchase.
More Than 370,000 Drivers Were Given Incorrect Tracking Information
The investigation uncovered another significant problem involving the information displayed to Smart Driver participants. According to multiple attorneys general, GM’s OnStar application incorrectly informed more than 370,000 drivers that they were not enrolled in the program, even though their driving information was being collected and sold. This was not simply a dispute over whether customers had read the terms. The information presented through the company’s own system reportedly contradicted what was happening behind the scenes. Investigators also alleged that GM subsequently removed those drivers from Smart Driver without notifying them about the mistake, while information already supplied to data brokers and insurers remained in those companies’ possession.
That finding raises a difficult question about how consumers can exercise control when the information provided by their vehicle manufacturer is inaccurate. A motorist who sees an inactive setting might reasonably believe that a particular tracking function is disabled. If information continues circulating elsewhere, changing an app preference may not resolve what has already happened. The case therefore concerns not only consent at the moment information is collected, but also notification, record retention, and accountability after information has been disclosed. Regulators have made these issues central to the settlement’s privacy requirements. For drivers, the distinction matters because stopping new collection and addressing historical information held by third parties are two separate challenges.
GM Faces Stronger Privacy Rules Following Previous Investigations
The October settlement follows several earlier actions involving GM’s treatment of connected-vehicle information. In April 2024, the company announced that it had ended data-sharing relationships with LexisNexis and Verisk, with those transfers stopping on March 20 of that year. The Federal Trade Commission subsequently pursued its own case, resulting in an order finalized in January 2026. That agreement imposes a five-year prohibition on sharing certain driving and location information with consumer reporting agencies. It also establishes longer-term obligations involving consent, transparency, and consumer control, including mechanisms for American consumers to request access to their information and seek its deletion.
California separately announced a $12.75 million settlement in May 2026, adding financial penalties and restrictions on data sales. The October agreement introduces further safeguards, including internal and independent assessments of GM’s privacy program, limits on data collection, and additional dealership training. GM has said the latest agreement reinforces measures it has already taken to improve transparency and customer choice. The company maintains that connected-vehicle information can support safer and more personalized driving experiences. However, the sequence of regulatory actions demonstrates that ending one controversial program does not necessarily resolve every concern about historical information or the broader systems responsible for collecting and distributing vehicle data.
Canadian Owners Have Reasons to Pay Attention, but Important Questions Remain
The Canadian implications require careful distinction. The US$220 million settlement resulted from an American investigation, and the announced findings do not establish that information belonging to Canadian GM owners was sold to insurers through the same arrangements. Canadian motorists are also not automatically entitled to compensation under this American agreement. Nevertheless, GM’s Canadian OnStar privacy statement describes an extensive range of information that its connected services may collect. That includes GPS location, vehicle speed, braking and cornering events, vehicle identification details, and information generated by safety systems. These disclosures demonstrate the capabilities of connected-vehicle technology, although they do not mean every vehicle continuously collects every listed category or shares it with insurers.
GM’s Canadian privacy documentation also acknowledges that personal information may be processed or stored outside Canada, including in the United States. The Office of the Privacy Commissioner of Canada has identified connected vehicles as an emerging privacy concern, noting in 2026 that these risks extend across manufacturers rather than belonging to vehicles from any single country. For Canadian owners, the central issue is therefore broader than whether the American Smart Driver controversy occurred in exactly the same way domestically. It concerns whether customers understand what information their vehicles transmit, where it travels, and which organizations can access it. As connectivity becomes increasingly integrated into modern vehicles, those questions are becoming part of the ownership experience rather than merely a technical consideration.
Canada’s Privacy Laws and Insurance Programs Make Consent Especially Important
Canadian privacy legislation already establishes expectations for how businesses handle personal information. Under the federal Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA, organizations generally must obtain meaningful consent before collecting, using, or disclosing personal information. The Office of the Privacy Commissioner emphasizes that consumers should understand the nature, purpose, and consequences of that consent. Sensitive information or uses outside reasonable expectations generally call for express permission. Alberta, British Columbia, and Quebec also have private-sector privacy legislation that may apply instead of the federal framework in certain circumstances. These protections do not prohibit all vehicle-data collection, but they create obligations around transparency, necessity, and consumer choice.
Canada also has legitimate insurance programs that use driving information. The Insurance Bureau of Canada identifies usage-based insurance, sometimes called telematics insurance, as an option that may help drivers reduce premiums by tracking driving habits through an app or device. Such programs are different from allegations that a manufacturer supplied information to insurance-related businesses without meaningful customer consent. The distinction is whether customers understand and authorize the arrangement. Research discussed by Canada’s privacy commissioner in 2026 also suggested significant differences between automakers’ approaches to collecting information and obtaining permission. For consumers, these developments reinforce the importance of distinguishing optional driving-monitoring services from ordinary vehicle functionality, particularly when information could eventually affect household expenses.
What Canadian GM Owners Can Do to Protect Their Driving Information
Canadian motorists concerned about connected-vehicle privacy can begin by reviewing the settings and permissions associated with their GM account, mobile applications, and OnStar services. GM publishes separate privacy documentation for its general Canadian operations and connected-vehicle services, making both relevant when examining data practices. Owners can ask the company what personal information it holds, why the information was collected, how long it is retained, and whether identifiable driving records have been disclosed to third parties. A request can also seek clarification about location history, driving-behaviour records, and available options for withdrawing consent. Some choices may affect connected features, so understanding the consequences before disabling services is important.
Canadian privacy law also provides mechanisms for requesting access to personal information. Under PIPEDA, organizations generally must respond to written access requests within 30 days, subject to permitted exceptions and extensions. GM Canada lists gmcanadaprivacy@gm.com for general privacy questions, while its Canadian OnStar privacy statement identifies privacy@gm.com for connected-service concerns. Consumers who believe their information was mishandled should first raise the issue directly with the organization and may then approach the appropriate privacy commissioner if the matter remains unresolved. None of these steps assumes that a particular Canadian driver was affected by the American controversy. Instead, they provide a practical way to understand how modern vehicles handle sensitive information. The larger lesson from GM’s settlement is that privacy should be treated as an essential part of vehicle ownership, alongside safety, reliability, and operating costs.
