GM settles multistate driver data case for $220 million
General Motors will pay $220 million to 36 US states to settle allegations that it illegally sold private driver behaviour and location information to data brokers. The agreement resolves a lawsuit brought by a coalition of state attorneys general and adds requirements for express consent, clearer disclosures and independent review of GM’s privacy programme.
The allegations concerned data gathered through Smart Driver, a free feature in GM connected-car applications that tracked and rated driving behaviour and seatbelt use. GM said the product was ended in 2024. The states alleged that information was sold to data brokers, which subsequently sold it to insurance providers.
Consent and oversight become settlement conditions
Under the multistate settlement, GM must obtain drivers’ express consent before collecting or sharing driving and location data. Those conditions align with separate agreements GM had already reached with California and the Federal Trade Commission.
A new element of the state agreement is a requirement for a third party to assess GM’s compliance with the privacy programme it has put in place. GM said the settlement addresses Smart Driver and reinforces measures intended to strengthen its privacy practices.
In January, the FTC finalised an order barring GM and its OnStar telematics service from sharing certain consumer data. Both that order and the multistate settlement require the company to be more transparent and to obtain explicit consent for specified collection activities.
Connected-car data remains commercially sensitive
A New York Times investigation published more than two years ago described how GM and OnStar collected, used and sold precise geolocation and driving-behaviour data to third parties, including LexisNexis and Verisk. The report said information supplied through brokers could affect customers’ insurance rates.
GM now says it will no longer sell vehicle information that can be linked to an individual, a vehicle’s location or the way a person drives. It may still disclose anonymised data that is not tied to an individual with certain partners. The company has also updated its privacy-policy language and created a consumer-facing Privacy Center.
Privacy choices shape connected services
The settlement arrives as automakers add more sensors, computing capacity and links to digital services inside vehicles. GM is also adding a personal AI assistant to OnStar, its safety and roadside-assistance service, with camera-supported live views, crash and safety recordings, voice controls and vehicle-feature questions.
GM has said customers will be able to choose what data is shared, that recordings have time limits and encryption, and that GM and OnStar cannot access Connected Camera recordings. Customers can manage permissions, although GM said people who decline to share data will likely have limited access to some features. For organisations building connected services, the case makes explicit consent, intelligible permissions and independently tested data governance practical requirements for sustaining customer trust.