General Motors has agreed to pay $220 million to 36 states to resolve claims of illegally selling private driving habits and location data to data brokers.
As part of this settlement, GM is required to obtain explicit consent from drivers before collecting or sharing their driving and location information. This aligns with previous agreements made with California and the Federal Trade Commission (FTC). The new settlement also mandates that GM undergo a third-party evaluation of its compliance with the privacy measures it has implemented.
Announced on Thursday, the agreement resolves a lawsuit filed by a group of attorneys general from 36 states who accused GM of selling consumers’ information to data brokers, which then sold it to insurance companies.
“This settlement relates to Smart Driver, a service we ended in 2024, and reinforces our commitment to enhancing privacy practices,” GM stated in an email. “The data collected from connected vehicles allows for safer and more personalized experiences, and GM is dedicated to being transparent regarding how this information is used, safeguarded, and the options available to customers regarding what they choose to share.”
This settlement follows a New York Times report from over two years ago that detailed how GM and OnStar gathered, processed, and sold precise geolocation and driving behavior data to third parties, including data brokers like LexisNexis and Verisk. Such data was taken from GM’s Smart Driver program, which tracked driving habits and seatbelt usage through its connected car applications and was initially offered for free. Data brokers then sold this information to insurance companies, potentially impacting customers’ insurance rates.
Although GM discontinued the Smart Driver program in 2024, legal challenges persisted. In January, the FTC finalized orders restricting GM and OnStar from sharing specific consumer data. Both this and the multi-state settlement require GM to enhance transparency with its users and obtain explicit consent for data collection.
GM stated that it now emphasizes protecting its customers’ privacy and will refrain from selling vehicle data that can be linked back to individuals, their locations, or driving habits. However, GM may still share anonymized data that cannot be traced back to any individual with select partners. The company has updated its privacy policy and established a consumer-oriented Privacy Center.
The settlement and required alterations to GM’s handling of driving data come at a time when more high-tech vehicles equipped with advanced sensors are emerging in the market. Manufacturers are heavily investing in vehicles reliant on software that enables interactions for both drivers and passengers with various digital applications, including calendars, messaging, and emails.
GM plans to introduce a personal AI assistant in its OnStar service, which has been operational for 30 years, enhancing safety and roadside assistance. The new features will integrate cameras to provide live views and record incidents for safety purposes. Users will also be able to control specific vehicle functions and ask questions using voice commands.
During its GM Forward event in October, the automaker highlighted its commitment to privacy in connection with the new assistant. GM assured customers that they could decide which data is shared, emphasizing that any recordings have expiration limits and are encrypted. Furthermore, GM confirmed that it and OnStar will not have access to the recordings from the Connected Camera. Customers will maintain control over data permissions, although those who opt out of data sharing may face restrictions on certain features.
