General Motors will pay $220 million to 36 states to settle allegations that it illegally sold private driving behavior and location information to data brokers.
As part of the settlement, GM must get drivers’ express consent before it collects or shares their driving and location data — terms that are in line with separate agreements it previously reached with California and the Federal Trade Commission (FTC). This settlement does contain a new requirement that GM must have a third party assess the automaker’s compliance with the privacy program it has put in place.
The agreement announced Thursday settles a lawsuit brought by a coalition of attorneys general from 36 states that alleged GM had sold the information to data brokers, which in turn then sold it to insurance providers.
“This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” GM said in an emailed statement. “Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share.”
The settlement comes more than two years after a New York Times report showed how GM and OnStar collected, used, and sold drivers’ precise geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data was collected through GM’s Smart Driver program, a free feature contained within its connected car apps that tracked and rated driving behaviors and seat belt use. Data brokers sold this information to insurance providers, which could affect customers’ rates, the NYT reported at the time.
GM discontinued Smart Driver in 2024, but that didn’t stop legal action. In January, the FTC finalized an order that bans GM and its OnStar telematics service from sharing certain consumer data. The FTC settlement, as well as the multistate one announced Thursday, also requires GM to be more transparent with its consumers and receive their explicit consent for certain collection.
The company now says it is focused on protecting the privacy of its customers and will no longer sell vehicle information that can be linked to an individual, their vehicle location, or how they drive. However, GM may still disclose anonymized data not tied to an individual with certain partners. GM has also updated the language in its privacy policy and created a consumer-facing Privacy Center.
