GM will pay $220 million to settle claims it sold drivers' data to insurers

The skim

• GM will pay $220 million to settle claims from 36 state attorneys general that it sold drivers' driving-behavior and location data to data brokers, who sold it on to insurers.
• The data came from GM's Smart Driver program and included trip times, hard braking, rapid acceleration and speeding. The states say some drivers paid higher premiums as a result.
• GM must now get drivers' express consent before collecting or sharing that data, limit what it collects and submit to outside privacy assessments. GM says it ended Smart Driver in 2024.

What the states found

From 2016 to 2024, GM enrolled millions of drivers in Smart Driver, a feature in its connected-car apps pitched as a way to drive more safely, according to Washington's attorney general, which co-led the case with Oregon. The states say GM told drivers it would not share their data with insurers without consent, then sold it to data brokers under contracts that specified insurance use. Insurers could see how often someone drove, when each trip started and ended, how often they braked or accelerated hard, and whether they sped.

The enrollment was the other problem. Most drivers signed up at the dealership, through the same process as OnStar, and in many cases salespeople allegedly accepted the terms for customers. Dealers earned bonuses partly on connected-service sign-ups. The OnStar app also wrongly told more than 370,000 drivers they weren't enrolled when they were, the states say, and GM later unenrolled them quietly while their data stayed with brokers and insurers.

"People bought a car, not a tracking device," Oregon Attorney General Dan Rayfield said, as quoted by The Verge.

Why it matters

This is the biggest bill yet for a practice The New York Times exposed in 2024, when it reported that GM data reached brokers including LexisNexis and Verisk and then insurers. The FTC finalized an order in January that bans GM and OnStar from sharing certain driver data, and GM agreed to a $12.75 million California settlement earlier this year. The state deal adds money and a new requirement: a third party has to assess GM's compliance with its privacy program, TechCrunch reports.

It also matters beyond GM. Cars now carry cameras, constant connections and AI assistants, and GM itself is adding an AI assistant and connected cameras to OnStar. "This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices," GM said in a statement. The company says it will no longer sell data tied to an individual, their location or how they drive, though it may still share anonymized data with partners.

What's next

The money goes to the states; Washington, for example, gets $12.3 million, and its announcement doesn't mention payments to individual drivers. The bigger change is the consent rule, which covers future data collection. If you drive a connected GM vehicle, it's worth checking what data-sharing settings are switched on in your OnStar or brand app.

Sources: Washington Attorney General, TechCrunch and The Verge.