GM Pays $220 Million to 36 States Over Driver Data Sales

General Motors will pay $220 million to 36 states to settle allegations that it illegally sold drivers' private driving behavior and location data to data brokers. That works out to roughly $6 million per state, and it puts a hard price tag on what a free in-app feature once cost the automaker in legal exposure.

The settlement, announced Thursday, resolves a lawsuit brought by a coalition of attorneys general from 36 states. The suit alleged GM sold driver information to data brokers, which then resold it to insurance providers — data that could affect customers' insurance rates.

What does the settlement require?

Under the terms, GM must obtain drivers' express consent before it collects or shares their driving and location data. Those conditions mirror separate agreements GM previously reached with California and the Federal Trade Commission. But this deal adds something new: a third-party assessor must evaluate GM's compliance with the privacy program it has put in place.

"This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices," GM said in an emailed statement. The company added: "Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it's protected, and the choices customers have about what they share."

How did this start?

The legal action traces back more than two years, to a New York Times report showing how GM and OnStar collected, used and sold drivers' precise geolocation data and driving behavior to third parties. The buyers included data brokers LexisNexis and Verisk.

The data came through GM's Smart Driver program, a free feature inside its connected car apps that tracked and rated driving behaviors and seatbelt use. Data brokers sold that information to insurance providers, which could affect customers' rates, the NYT reported at the time.

GM discontinued Smart Driver in 2024, but that didn't end the legal pressure. In January, the FTC finalized an order banning GM and its OnStar telematics service from sharing certain consumer data. Both the FTC order and Thursday's multi-state settlement require GM to be more transparent with consumers and get explicit consent for certain collection.

Where does GM's data business stand now?

GM says it is focused on protecting customer privacy and will no longer sell vehicle information that can be linked to an individual, their vehicle location, or how they drive. The automaker may still disclose anonymized data not tied to an individual to certain partners. GM has also updated the language in its privacy policy and built a consumer-facing Privacy Center.

The stakes are rising, not falling. More sensor-laden vehicles with serious computing power are entering the market, and automakers have made large bets on software-centric vehicles that connect to digital apps like calendars, messages and email.

GM itself is adding a personal AI assistant to OnStar, its 30-year-old safety and roadside assistance service. Vehicle cameras will connect to the software to offer live views plus crash and safety recordings. Users will control functions like climate by voice and ask questions about specific vehicle features.

At its GM Forward event in October, the company emphasized privacy protections for the new assistant. Customers can decide what data is shared; recordings have time limits and are encrypted. GM said it and OnStar cannot access Connected Camera recordings, and customers can manage permissions.

There's a catch worth noting for practitioners: customers who opt not to share their data will likely face limited access to certain features, according to GM. That trade-off — consent versus capability — is now the central question for every connected-vehicle data program, and the $220 million settlement shows what regulators will charge when it's handled wrong.