General Motors will pay $220 million to 36 states to settle allegations of illegally selling private driving behavior and location information to data brokers.
As part of the settlement, General Motors must obtain explicit consent from drivers before collecting or sharing their driving and location information. These terms are in line with previous agreements the company reached with the State of California and the United States Federal Trade Commission ( FTC ). The settlement also adds a new requirement that General Motors must have its established privacy programs assessed for compliance by a third party.
The agreement, announced on Thursday, settled a lawsuit filed by an alliance of attorneys general from 36 states. The alliance accused General Motors of selling relevant information to data brokers, who in turn sold this information to insurance companies.
"This agreement relates to Smart Driver – a product that we discontinued in 2024 – and it strengthens the measures we have taken to enhance privacy practices," General Motors stated in an email statement. "A safer, more helpful, and more personalized experience is made possible by data from connected vehicles; General Motors is committed to clearly explaining which information will be used, how it will be protected, and what choices customers have regarding the content they share."
It has been over two years since this settlement was reached, following a report by The New York Times. That report disclosed how General Motors and OnStar collected, used, and sold precise geographic location data and driving behavior information of drivers to third parties, including data brokers LexisNexis and Verisk. The relevant data was collected through General Motors' Smart Driver program, which is a free feature in its connected car applications that tracks and evaluates driving behavior and seatbelt usage. As reported at the time by NYT, these data brokers sold this information to insurance companies, which could potentially affect customers' insurance premiums.
General Motors discontinued Smart Driver in 2024, but this did not stop legal actions. In January of this year, a court order was finally issued, prohibiting General Motors and its OnStar remote information processing services from sharing certain consumer data. The settlement with FTC, as well as the multi-state settlement announced on Thursday, also require General Motors to be more transparent with consumers and to obtain their explicit consent for certain data collections.
General Motors now states that the company is focused on protecting customer privacy and will no longer sell vehicle information that can be linked to individuals, their vehicle locations, or their driving styles. However, General Motors may still disclose anonymized data that is not related to individuals to certain partners. The company has also updated the wording of its privacy policy and established a Privacy Center for consumers.
As vehicles equipped with more sensors and computing power enter the market, General Motors' settlement and the mandatory adjustments to the way it handles customer driving data have also followed. Automobile manufacturers have invested heavily in software-driven vehicles that allow drivers and passengers to interact and connect to other digital applications such as calendars, messaging, and email.
For example, General Motors is adding personal AI assistants to OnStar. OnStar is its safety and road rescue service that has a history of 30 years. In-car cameras will be connected to the software to provide real-time footage as well as collision and safety records. Users will also be able to control certain vehicle functions via voice, including the air conditioning, and can ask questions about any specific vehicle feature.
When General Motors announced this new assistant at its GM Forward event in October, it emphasized its privacy protection measures. The company stated that customers will be able to decide which data to share, and that the related recordings are time-limited and encrypted. General Motors said that it and OnStar do not have access to the recordings of Connected Camera. Customers can also manage their permissions. However, according to General Motors, customers who choose not to share data may not be able to use certain functions, or may only be able to use them limitedly.
