A $220 million GM data privacy settlement has resolved allegations from 36 US states that the vehicle manufacturer tracked motorists without proper consent and sold their location and driving records to third-party data brokers, who then shared the details with insurance companies to adjust driver rates.
Key points
- General Motors agreed to pay $220 million to conclude a multistate investigation co-led by attorneys general in Washington and Oregon.
- The manufacturer enrolled millions of motorists in its Smart Driver feature between 2016 and 2024, tracking acceleration, braking, and journey times.
- Data brokers supplied the resulting behavioural scores to insurance carriers, who used the files to increase consumer premium rates.
- The settlement mandates affirmative express consent for driving telemetry and requires regular audits by independent evaluators.
How the Smart Driver system tracked motorists
The settlement concludes an investigation into GM’s connected vehicle practices that began after investigative reporting exposed widespread data transfers in 2024. Washington Attorney General Nick Brown and Oregon Attorney General Dan Rayfield co-led the 36-state coalition, which also included New York, Florida, Michigan, Nevada, and Pennsylvania.
State authorities found that GM gathered telemetry from millions of people through its Smart Driver feature between 2016 and 2024. The carmaker pitched the built-in software as a tool designed to help motorists monitor their habits and improve road safety. GM also told customers that it would not transfer their information to insurers without their clear permission.
Investigators found the company broke that commitment by providing driver files to commercial data brokers, including LexisNexis and Verisk. GM signed contracts acknowledging that these brokers intended to make commercial gains by selling the information to insurance companies, according to the coalition.
The information transferred by the carmaker was detailed and personally identifiable. As outlined in a press release from the Washington attorney general, brokers received data showing how frequently individuals drove, journey start and end times, instances of rapid acceleration or harsh braking, and whether the driver exceeded posted speed limits. Insurers subsequently used those metrics to raise premiums on motorists.
Dealership sales pressure and missing disclosures
Most motorists were enrolled into Smart Driver at franchised dealerships while completing vehicle purchases. Dealership employees faced commercial incentives to sign buyers up, receiving cash bonuses for every successful registration in the service. GM also monitored store performance by ranking dealerships against each other according to their total sign-ups.
The registration procedure bundled Smart Driver enrollment into the activation workflow for GM’s OnStar connected vehicle platform. Because OnStar relied on factory-installed hardware embedded during vehicle assembly, its continuous surveillance captured far more detailed behavioural data than optional dongles or mobile applications distributed by insurance carriers.
State investigators also identified record-keeping errors that left hundreds of thousands of car buyers misinformed. GM sent messages to more than 370,000 drivers stating that their vehicles were not being monitored because they were not enrolled in Smart Driver. After realising the mistake, the company quietly cancelled their registrations without informing the affected drivers or recalling the information already supplied to data brokers.
In a public statement published by the Oregon Department of Justice, Rayfield criticised the company’s covert monitoring practices. “People bought a car, not a tracking device,” Rayfield said in a press release.
Requirements under the multistate agreement
Under the terms of the settlement, GM must obtain affirmative express consent from vehicle owners prior to collecting, using, or transmitting location and driving telemetry. The carmaker must also implement data minimisation rules and establish an internal privacy programme to safeguard consumer records.
The decree requires GM to submit to regular privacy assessments conducted by independent external evaluators as well as internal reviews. The manufacturer must also increase training and oversight for dealership personnel to ensure staff do not register car buyers without their explicit knowledge and agreement.
GM ended the Smart Driver product in 2024 following public criticism. The company confirmed the financial penalty while defending its broader technology roadmap. In an emailed statement, GM spokesperson Charlotte McCoy addressed the terms. “This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” McCoy said.
McCoy said connected vehicle data allows the manufacturer to deliver personalised and safer consumer tools. The carmaker said it has updated its customer privacy centre and will no longer sell individual location or driving records, though it may still share aggregated, non-identifiable data sets with outside commercial partners.
Scrutiny over connected vehicle software
The $220 million payment follows several regulatory actions targeting connected vehicle telematics. GM previously paid $12.75 million to resolve a data privacy dispute with the state of California. In January, the Federal Trade Commission finalised an enforcement order that barred GM and OnStar from disclosing specified consumer data and required explicit customer consent for future data collection.
The company still confronts litigation in other jurisdictions. Texas Attorney General Ken Paxton filed an enforcement lawsuit against GM in 2024 over deceptive data practices. In that action, Paxton wants a court order requiring the company to delete all gathered driver records, alongside fines reaching $10,000 for each violation and a trial before a jury.
Connected car features and onboard software have become central to manufacturer business models. Modern vehicles rely on mobile networks, internal cameras, and sensor arrays to provide automated services. GM recently announced plans to integrate an artificial intelligence assistant into OnStar, using cameras to offer live monitoring alongside automated collision recordings.
GM said camera recordings for the new software are encrypted and subject to deletion timers, with customers retaining permission controls. Drivers who refuse data sharing may find their access to specific digital features limited. The multistate settlement sets binding operational restrictions on how automakers handle driver telemetry, forcing companies to prove that software revenues do not rely on covert vehicle tracking.
