A coalition of 36 state attorneys general reached a settlement with General Motors on Thursday, requiring the automaker to pay $220 million over claims it unlawfully transferred consumers' location and driving behavior data to third parties, including data brokers who subsequently sold the information to insurers. The practice directly influenced insurance pricing for affected drivers, according to a statement from Washington Attorney General Nick Brown, who co-led the enforcement action.
The settlement mandates that GM obtain explicit affirmative consent from customers before collecting or sharing their driving behavior and location data. From 2016 until 2024, when the New York Times first reported on the scheme, GM allegedly enrolled millions of people in its "Smart Driver" program, which tracked their driving patterns. The company promoted the program as a tool to help drivers improve their safety record, while simultaneously assuring participants that insurers would not receive their data without explicit permission.
Despite these assurances, GM allegedly sold the collected information to data brokers with full knowledge that the brokers intended to profit by distributing it to insurance companies. Participating customers were never informed of this arrangement. A GM spokesperson responded by stating that the "agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices," adding that "Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it's protected, and the choices customers have about what they share."
Pressure and deception
Many customers enrolled in Smart Driver at automobile dealerships during the vehicle purchase process, with numerous accounts describing high-pressure sales tactics. The enrollment process for Smart Driver simultaneously registered drivers into GM's OnStar services. This data collection infrastructure operated with factory-level surveillance capabilities that far surpassed what insurance companies could gather through their own discount-based driving monitoring programs.
Dealership staff received financial bonuses for successfully signing up customers to Smart Driver, while dealerships themselves earned incentives and were ranked against one another based on enrollment metrics, according to the attorneys general. Additionally, GM mistakenly told more than 370,000 customers that their data was not being tracked because they had not subscribed to Smart Driver. The company subsequently removed these drivers from the program without notifying them of the error, and the data already collected was never deleted from the data brokers' and insurers' systems.
The information GM transferred was highly granular and personally identifiable. "Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit," the attorneys general stated. GM discontinued the program following public backlash triggered by the New York Times investigation.
New privacy requirements
Under the settlement agreement, GM must reduce the volume of driving data it collects and implement comprehensive safeguards as part of a broader data privacy program. The terms represent "significantly stronger than any other resolution reached with GM for this conduct including by mandating internal and external data protection and privacy program assessments," according to the attorneys general. The company must also strengthen oversight and training for dealership personnel to prevent unauthorized enrollment in data collection initiatives.
A separate lawsuit brought by Texas Attorney General Ken Paxton in 2024 remains unresolved. Paxton has characterized GM's handling of driver data as "false, deceptive, and misleading," citing the collection, sale to brokers, and subsequent distribution to insurers. Texas is pursuing a jury trial and seeking civil penalties of up to $10,000 per violation, along with a court order requiring GM to destroy all collected data.
