General Motors will hand over $220m to 35 US states and the District of Columbia following allegations that it sold drivers' personal data to data brokers, who then distributed it to insurance firms. The settlement, announced Thursday by Washington's attorney general Nick Brown, requires GM to obtain explicit consent from drivers before collecting or sharing their driving and location information. Washington and Oregon spearheaded the coalition of 36 attorneys general that pursued the case.

Oregon's complaint detailed how GM generated more than $20m by selling Smart Driver data while simultaneously telling 370,000 enrolled drivers that they were not actually signed up for the programme. The company did not admit to any wrongdoing as part of the settlement. Washington will receive $12.3m from the payout, while New York will get approximately $12.1m.

People bought a car, not a tracking device

Oregon Attorney General Dan Rayfield

What the states say GM did

GM introduced Smart Driver in 2015 as part of its OnStar service, marketing it as a safety feature. The system monitored hard braking, hard acceleration, hard cornering, excessive speeds, seat belt compliance, late-night driving and journey duration.

Starting that same year, GM began licensing OnStar and Smart Driver data to Verisk Analytics, according to the complaint. A second agreement with LexisNexis Risk Solutions followed in 2019. Both companies converted the data into driver reports and ratings for insurance providers, which some insurers then used to determine premium rates. Nationwide, these data sales generated more than $20m for GM.

Although drivers could enrol in an insurance discount scheme that GM claimed would share only anonymised information, the company actually sold identifiable data on all Smart Driver participants, the states alleged.

The data GM sold was personal, identifiable, and specific

Nick Brown, Washington's attorney general

The complaint also addresses location tracking. Beginning in 2018, GM collected precise vehicle location data every three seconds from engine start. From 2019 onwards, this information included an identifier linking it to a specific vehicle. GM licensed the location data to Wejo, a UK-based connected-car data company. Jacobs Engineering acquired Wejo's assets in January 2024 and subsequently signed its own licensing agreement with GM.

Dealers, bonuses and a glitch

Most drivers enrolled in the programme at dealerships when purchasing their vehicles. GM incentivised dealership staff with bonuses tied partly to enrolment numbers and ranked dealerships based on their sign-up rates. In numerous instances, staff allegedly accepted the terms without explicit customer approval.

When customers attempted to reject OnStar terms, a warning message claimed they would forfeit crash response and emergency services, the complaint states. Additionally, GM's application informed over 370,000 enrolled drivers that they were not participating in Smart Driver. The company subsequently removed them from the programme without notification, yet their data remained with the brokers and insurers.

From a newspaper story to a settlement

The practice surfaced publicly in March 2024 when Kashmir Hill's reporting in The New York Times revealed that GM was sharing Smart Driver data with LexisNexis and Verisk. One Chevrolet Bolt owner experienced a 21% insurance increase in 2022; his LexisNexis report documented 640 trips across six months, including start and end times, speeding incidents and hard braking events. GM discontinued Smart Driver in April 2024.

In January 2025, the Federal Trade Commission sought to prohibit GM from sharing certain driver data with consumer reporting agencies for five years, finalising that order this January. GM also paid $12.75m in May to resolve comparable allegations in California. A separate lawsuit from Texas remains pending, according to reporting.

Under the new settlement terms, GM must restrict the driving data it collects and establish a data privacy programme featuring internal and external assessments, along with staff training and oversight at dealerships. The company did not acknowledge wrongdoing.

This agreement addresses Smart Driver, a product we ended in 2024

General Motors

GM stated to TechCrunch that it no longer sells vehicle data linked to individuals, though it may continue sharing non-identifiable information. The automaker is developing its own AI assistant for vehicles. Separately, Volvo offers a driving evaluation app that shares grades with insurers, and in September, Ireland's data protection authority imposed a €403m fine on Google regarding location data practices.

Source: The Next Web