General Motors will pay $220 million to 36 states to settle allegations that it illegally sold private driving behavior and location information to data brokers.
As part of the settlement, GM must get drivers’ express consent before it collects or shares their driving and location data — terms that are in line with separate agreements it previously reached with California and the Federal Trade Commission (FTC). This settlement does contain a new requirement that GM must have a third party assess the automaker’s compliance with the privacy program it has put in place.
The agreement announced Thursday settles a lawsuit brought by a coalition of attorneys general from 36 states that alleged GM had sold the information to data brokers, which in turn then sold it to insurance providers.
“This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” GM said in an emailed statement. “Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share.”
The settlement comes more than two years after a New York Times report showed how GM and OnStar collected, used, and sold drivers’ precise geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data was collected through GM’s Smart Driver program, a free feature contained within its connected car apps that tracked and rated driving behaviors and seat belt use. Data brokers sold this information to insurance providers, which could affect customers’ rates, the NYT reported at the time.
GM discontinued Smart Driver in 2024, but that didn’t stop legal action. In January, the FTC finalized an order that bans GM and its OnStar telematics service from sharing certain consumer data. The FTC settlement, as well as the multistate one announced Thursday, also requires GM to be more transparent with its consumers and receive their explicit consent for certain collection.
The company now says it is focused on protecting the privacy of its customers and will no longer sell vehicle information that can be linked to an individual, their vehicle location, or how they drive. However, GM may still disclose anonymized data not tied to an individual with certain partners. GM has also updated the language in its privacy policy and created a consumer-facing Privacy Center.
The settlement and mandated changes to how GM handles customer driving data come as more sensor-laden vehicles equipped with computing power enter the market. Automakers have made large bets on software-centric vehicles that drivers and passengers can interact with and connect with other digital apps such as their calendar, messages, and email.
For instance, GM is adding a personal AI assistant to OnStar, its 30-year-old safety and roadside assistance service. Cameras on the vehicle will be connected to the software to offer live views as well as crash and safety recordings. Users will also be able to use voice to control certain functions on the vehicle, including climate, and ask questions about any specific vehicle feature.
The automaker emphasized its privacy protections when it announced the new assistant during its GM Forward event in October. The company said customers will have the ability to decide what data is shared and that the recordings have time limits and are encrypted. GM said it and OnStar cannot access Connected Camera recordings. Customers will also be able to manage permissions. However, customers who opt not to share their data will likely have limited access to certain features, according to GM.
