GM Agrees to $220M Settlement Over Illegal Sale of Driver Data

Major Settlement for Data Privacy Violations

General Motors has reached a $220 million settlement with a coalition of 36 US state attorneys general to resolve allegations that the automaker illegally sold private driving behavior and location information to third-party data brokers. The agreement, announced on Thursday, marks the largest penalty of its kind for the automotive industry and addresses long-standing concerns regarding consumer privacy in the era of connected vehicles. The settlement resolves a complaint that GM failed to adequately notify drivers about the extent of data collection and shared sensitive information that could be used to profile individual drivers.

The allegations centered on GM’s Smart Driver program, a free feature offered to vehicle owners that collected detailed data on driving habits. According to the complaint, the program gathered information including acceleration patterns, braking intensity, trip length, and precise geolocation. This data was then passed to data brokers, including LexisNexis and Verisk, who subsequently sold the information to insurance providers. These insurers allegedly used the data to adjust premiums, effectively penalizing drivers based on their recorded behavior without their explicit knowledge or consent. The New York Times first exposed these practices in a report more than two years ago, detailing how GM and its OnStar division collected and monetized this precise geolocation data.

Strict New Consent Requirements

As part of the settlement, GM is required to implement significant changes to its data privacy practices. The automaker must now obtain express consent from drivers before collecting or sharing their driving and location data. This requirement aligns with previous agreements GM reached with the Federal Trade Commission and the state of California, where it paid $12.75 million to settle similar claims earlier this year. The new agreement also introduces a novel compliance mechanism: GM must submit to annual third-party audits to assess its adherence to the privacy program it has established. These audits are designed to ensure that the company’s internal controls are effective and that consumer data is handled in accordance with the new legal standards.

GM has stated that the Smart Driver program was discontinued in 2024. In a statement, GM spokesperson Charlotte McCoy emphasized that the settlement addresses the Smart Driver program specifically and reinforces steps the company has taken to strengthen its overall privacy practices. "Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share," McCoy said. The company argued that the agreement resolves the specific issues raised by the states without admitting fault in a broader legal sense, focusing instead on future compliance.

Regulatory Impact and Industry Implications

The settlement was co-led by Oregon Attorney General Dan Rayfield and Washington Attorney General Nick Brown, with participation from a broad coalition of state officials. The case highlights the growing tension between automakers’ desire to monetize vehicle data and consumers’ right to privacy. Regulators argue that the opaque nature of data sharing in the automotive sector has left drivers vulnerable to financial penalties and surveillance without their knowledge. The $220 million penalty serves as a stark warning to other technology and automotive companies that rely on data aggregation for revenue.

Privacy advocates and consumer protection groups have welcomed the settlement as a significant step forward. They argue that the case underscores the need for stricter federal regulations on data collection in connected vehicles. While GM has agreed to the terms, the broader implications for the industry remain to be seen. Other automakers are currently under scrutiny for similar data practices, and this settlement may prompt further investigations by state and federal regulators. The requirement for express consent and third-party audits sets a new precedent for how automotive data must be handled, potentially reshaping business models that rely on the sale of user behavior data.

Key takeaways

• General Motors agreed to pay $220 million to settle claims of illegally selling driver data to brokers.
• The settlement resolves a lawsuit by 36 US states regarding the discontinued Smart Driver program.
• GM must now obtain express consent before collecting or sharing driving and location data.
• The automaker will undergo annual third-party audits to ensure compliance with new privacy rules.
• The data was previously sold to insurers, who used it to adjust driver premiums.
• This follows a $12.75 million settlement GM paid to California for similar privacy violations.