General Motors will pay $220 million to settle allegations that it illegally sold consumers’ private driver behavior data and location information to third parties, according to an October 29 statement. The settlement, co-led by Washington, resolves claims that data was sold to brokers and subsequently used by insurance companies to influence premium rates.
Washington will receive $12.3 million through the settlement, which was reached by a coalition of 36 attorneys general. Under the terms of the agreement, General Motors must obtain affirmative express consent from consumers before collecting or disclosing driving and location data. The company is also required to limit the driving data it collects and implement a comprehensive data privacy program that includes internal and external assessments.
The investigation revealed that from 2016 to 2024, General Motors enrolled millions of drivers in its Smart Driver program to track driving habits. While the company pitched the tool as a way to improve safety and stated data would not be shared with insurers without express consent, investigators found the company sold information to data brokers for use in insurance products. This data included specific, identifiable information such as trip start and end times, braking and acceleration frequency, and speeding instances.
The settlement addresses issues regarding how drivers were enrolled in the program, often at dealerships during vehicle purchases. Allegations suggest dealership employees sometimes accepted terms on behalf of customers without consent, partly driven by sales incentives for OnStar and connected vehicle services. Additionally, General Motors systems mistakenly told over 370,000 drivers they were not enrolled in Smart Driver when they actually were, and the company later unenrolled those drivers without notification.
Attorney General Nick Brown stated that Washingtonians' data is personal and valuable, requiring consumer control over its use. Brown noted that the bipartisan agreement holds General Motors accountable for misusing driver data.
