General Motors will pay $220 million to settle allegations from a 36-state coalition that the automaker sold drivers' private driving and location data to third-party brokers without customer permission, according to a October 29 report.
Oregon, which co-led the multi-state coalition alongside Washington, will receive more than $10.4 million from the settlement.
The settlement addresses GM's Smart Driver program, which tracked driving habits for millions of vehicle owners between 2016 and 2024. State investigators found that GM pitched the program as a safety tool and promised not to share data with insurance companies without express consent, but sold the information to data brokers who then provided it to insurers to adjust rates.
Most customers were enrolled in Smart Driver at dealerships through a unified sign-up process for GM's OnStar service. To meet corporate enrollment targets that tied sales bonuses to connected vehicle sign-ups, dealership employees frequently accepted terms and conditions on behalf of buyers without their knowledge.
The investigation revealed that GM's OnStar mobile application incorrectly informed more than 370,000 drivers that they were not enrolled in Smart Driver while continuing to collect and sell their data. GM later quietly unenrolled those drivers without notifying them of the error, leaving previously collected information with data brokers and insurance providers.
The collected data was personal and specific, detailing trip start and end times, trip frequency, hard braking, rapid acceleration, and speeding. GM ended the Smart Driver program after public reporting by The New York Times detailed how insurers used the information to adjust rates.
Oregon Attorney General Dan Rayfield co-led the multi-state investigation alongside Washington Attorney General Nick Brown. Rayfield stated that people bought a car rather than a tracking device and noted that while GM promised the program would not share data with insurers without permission, the investigation found GM sold that data anyway, resulting in some drivers paying higher premiums.
Oregon filed its enforcement action under the state Unlawful Trade Practices Act because much of GM's conduct occurred before the Oregon Consumer Privacy Act took effect in July 2024. The newer privacy statute restricts all covered entities from selling precise geolocation data belonging to state residents.
The investigation was supported by an executive committee consisting of attorneys general from Colorado, Conn., Del., Ill., Ky., Md., Minn., N.J., Utah and Vermont, along with 24 other states and the District of Columbia.
Under the settlement terms, GM must obtain affirmative, express consent before collecting or sharing driver data, limit the driving information it gathers, establish a comprehensive data privacy program, and undergo both internal and external privacy assessments. The automaker is also required to implement dealership oversight and training to prevent unauthorized customer sign-ups.
