GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms

General Motors on Thursday agreed to pay $220 million to settle a lawsuit filed by a coalition of 36 state attorneys general who alleged the company unlawfully sold consumers’ location and driving behavior data to outside parties, including data brokers.

The data brokers then sold the sensitive data to insurers, affecting the prices drivers were charged for insurance, according to a press release from Washington Attorney General Nick Brown, who co-led the coalition’s efforts.

In addition to the fine, the settlement requires GM to ask customers for their affirmative express consent prior to collecting or sharing consumer driving behavior and location data 

Beginning in 2016 and running through 2024, when the New York Times exposed the practice, GM allegedly enrolled millions of people in their “Smart Driver” program, allowing the auto giant to monitor their driving habits.

The company allegedly marketed the program to customers by emphasizing participation could help drivers bolster their driving safety. The manufacturer also allegedly promised customers that it would not give insurers their data without their affirmative consent.

However, GM allegedly broke that promise by selling the information to data brokers despite contract language it signed indicating the brokers planned to profit by providing the data to insurers. GM did not tell participating customers they would do so, the suit alleged.

A GM spokesperson said in an emailed statement that the “agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.”

“Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” they said. 

Pressure and deception

Most customers agreed to participate in the Smart Driver program at dealerships as they were purchasing cars, and many have described pressure tactics that convinced them to sign. 

The one time sign-up process for drivers to enroll in Smart Driver also swept them into GM’s OnStar services. The data collection system operated with built-in factory surveillance far exceeding what insurers could collect by offering customers discounts to sign up for their own driving behavior trackers. 

Dealership employees were allegedly given bonuses for successfully enrolling customers in Smart Driver and dealerships also received incentives with GM ranking them against each other based on enrollment numbers, the press release said.

The automaker also mistakenly informed more than 370,000 customers their data was not being monitored because they were not enrolled in Smart Driver, the attorneys general contend. GM  subsequently unenrolled the drivers, but allegedly did so secretly and without alerting customers to the mistake. The data that had already been collected was allegedly not withdrawn from the data brokers and insurers.

“The data GM sold was personal, identifiable, and specific,” the press release said. “Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit.” 

Following an outcry prompted by the New York Times’ revelations, GM shut down the program.

Under the settlement, GM must minimize the driving data it takes from consumers and safeguard their information as part of a comprehensive data privacy program, the press release said.

The settlement terms are “significantly stronger than any other resolution reached with GM for this conduct including by mandating internal and external data protection and privacy program assessments,” the press release said. 

GM also agreed to augment oversight and training for dealership employees to ensure they do not sign customers up for data collection programs without their approval.

A similar lawsuit filed against GM by Texas Attorney General Ken Paxton in 2024 is ongoing.

Paxton has alleged the car manufacturer handled drivers’ data in a “false, deceptive, and misleading” way by collecting data from customers, selling it to data brokers and allowing the brokers to in turn peddle it to insurers.

Texas is seeking a jury trial and civil penalties of up to $10,000 per offense, along with a court order directing GM to delete the collected data.