GM Allegedly Sold Your Driving Data. Now The Company Must Pay $220 Million

The automaker must implement new privacy assessments and dealership training requirements as part of the settlement with 36 states.

By: Anthony Alaniz

Oct 30, at 4:01pm ET

Comment

General Motors will pay $220 million to 36 states and the District of Columbia to settle allegations the Detroit-based automaker improperly collected and sold drivers’ personal information. The automaker sold that data to insurance companies, resulting in higher premiums for drivers.

The investigation, led by Washington and Oregon, found that from 2014 to 2024, GM enrolled “millions of drivers” in its Smart Driver program. According to the press release from the Washington Office of the Attorney General, the automaker told drivers it would not share their data with insurers without consent but did so anyway.

Many customers signed up for Smart Driver during the purchase process at a dealership. Dealership employees allegedly enrolled people in the program without their consent at a time when the automaker rewarded sales employees with bonuses based on signups.

The investigation also found that GM’s OnStar app mistakenly told over 370,000 drivers they were not enrolled in the Smart Driver program when they were. GM unenrolled those drivers without telling them, while allowing data brokers to retain the data. Washington Attorney General Nick Brown said:

‘Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used. We’re proud to lead this bipartisan agreement holding GM accountable for misusing drivers’ data.’

GM ended its Smart Driver program in April 2024.

Photo by: General Motors

What Is GM Doing Now?

General Motors has agreed to limit the data it collects on its drivers and protect that information as part of a “comprehensive data privacy program.” The consent decree mandates internal and external data and privacy protection assessments.

The automaker will also implement oversight and training requirements for dealerships. GM now must obtain affirmative express consent from consumers before collecting or sharing driver data.

In January 2025, the US Federal Trade Commission banned the automaker from selling sensitive driver data. After The New York Times report initially uncovered that the automaker was sharing personal driving data with insurance companies, GM ended its relationship with LexisNexis and Verisk, two prominent data brokers.

Earlier this year, GM agreed to pay California $12.75 million for selling its residents’ data without proper consent. Texas filed a lawsuit against the automaker in 2024 for its privacy practices.

What Data Was GM Collecting?

According to the investigation, GM sold “personal, identifiable, and specific” information. Insurance companies had data showing how often a person braked or accelerated, if they sped, and the dates and times of their travels.

What do you think?

View

Comments

Collecting and selling this data led insurance companies to raise premiums for some drivers. Since the initial investigation into GM’s data practices two years ago, several states have opened investigations into the automaker.

The case was co-led by Washington and Oregon, with assistance from Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont. The attorneys general of Alabama, Alaska, Arizona, the District of Columbia, Florida, Hawaii, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, and Wisconsin also joined.