General Motors Settles Multi-State Data Privacy Lawsuit for $220 Million
Automaker resolves claims regarding unauthorized driver data sales to insurance companies.
1Massive Settlement Reached
General Motors has agreed to a $220 million settlement with 35 US states and the District of Columbia. This resolution addresses allegations that the automaker improperly sold driver data to insurance companies. The legal action followed reports that GM tracked customer driving habits through its OnStar Smart Driver program without obtaining explicit consent.
2Program Data Collection Scope
Between 2016 and 2024, GM enrolled millions of customers into the Smart Driver program. The system logged specific driving behaviors including hard braking, speeding, and late-night driving patterns. This identifiable information was subsequently sold to data brokers, which directly influenced insurance companies to increase premiums for many of the affected vehicle owners.
3Dealership Enrollment Practices
The investigation revealed that GM incentivized dealership employees with bonuses to maximize program sign-ups. In numerous instances, dealership staff allegedly accepted terms and conditions on behalf of customers without their express permission. This aggressive sales strategy resulted in many drivers being enrolled in the tracking program without their knowledge or any clear disclosure.
4Systemic Enrollment Failures
Attorneys general reported that over 370,000 drivers were incorrectly told they were not enrolled in the program when they actually were. Although GM eventually unenrolled these individuals, the company failed to notify them of the error. Furthermore, the automaker continued to sell their personal data despite the known inaccuracies in the enrollment status.
5Mandated Privacy Compliance Measures
As part of the settlement, GM must strictly limit the driving data it collects from customers moving forward. The company is now required to implement robust protections for personal information. These operational changes include mandatory internal and external assessments of their data privacy programs to ensure future compliance with state and federal legal standards.
6Enhanced Dealership Oversight
The settlement mandates additional training for all dealership employees regarding data collection and customer consent protocols. This oversight aims to prevent the recurrence of unauthorized enrollments and ensure transparency in how vehicle data is handled. GM must now maintain stricter control over how its retail network interacts with customer privacy and data agreements.
7Prior Regulatory Actions
This $220 million agreement follows earlier regulatory interventions regarding GM's data practices. The Federal Trade Commission previously banned the automaker from sharing specific consumer data with third parties for a five-year period. Additionally, GM reached a separate settlement with the state of California earlier this year, which required a payment of $12.75 million.
8Industry Data Implications
The case highlights the growing tension between connected vehicle technology and consumer privacy rights. As automakers increasingly monetize driving data, the legal scrutiny surrounding consent and transparency is intensifying. This settlement serves as a significant benchmark for how major manufacturers must manage and protect sensitive consumer information within their digital service ecosystems.