General Motors Settles Multi-State Data Privacy Lawsuit for $220 Million
Automaker resolves claims regarding unauthorized driver data sales to insurance companies.
1Massive Multi-State Settlement Reached
General Motors has agreed to a $220 million settlement to resolve a lawsuit involving 35 US states and the District of Columbia. The legal action followed allegations that the automaker mishandled customer data through its OnStar Smart Driver program. This resolution addresses systemic privacy concerns spanning an eight-year period from 2016 to 2024.
2Unauthorized Data Monetization Practices
The core of the dispute involved GM tracking driving habits like hard braking, speeding, and late-night driving. Without obtaining explicit customer permission, the company sold this granular information to data brokers. Consequently, insurance providers utilized these metrics to increase premiums for unsuspecting drivers who were unaware their personal data was being monetized.
3Dealership Enrollment and Consent Issues
The investigation revealed that GM incentivized dealership employees with bonuses to maximize Smart Driver sign-ups. In several instances, staff allegedly accepted terms and conditions on behalf of customers without their consent. This aggressive enrollment strategy resulted in millions of drivers being tracked while remaining completely unaware of their participation in the data program.
4Misleading Communication and Data Handling
Attorneys general reported that over 370,000 drivers were incorrectly informed they were not enrolled in the program. Despite eventually unenrolling these individuals, GM failed to notify them of the error and continued selling their identifiable data. This practice highlights a significant breakdown in internal transparency and data management protocols during the specified timeframe.
5Mandated Privacy and Oversight Reforms
Under the terms of the settlement, GM must strictly limit the driving data it collects and enhance protections for personal information. The company is now subject to mandatory internal and external privacy assessments. Furthermore, GM must implement additional training programs at its dealerships to ensure future compliance with consumer data protection standards.
6Regulatory Context and Previous Actions
This settlement follows earlier regulatory interventions regarding the same issue. The Federal Trade Commission previously banned GM from sharing specific consumer data with third parties for five years. Additionally, the automaker reached a separate $12.75 million settlement with the state of California in May, further underscoring the legal pressure surrounding their data practices.
7Impact on Automotive Data Standards
The case sets a significant precedent for how automotive companies handle connected vehicle data. By linking driving behavior to insurance premiums without clear consent, GM faced intense scrutiny from state regulators. This outcome forces the industry to re-evaluate the balance between vehicle connectivity features and the fundamental right to consumer data privacy.
8Future Implications for GM Operations
Moving forward, GM faces rigorous oversight to prevent similar privacy lapses. The combination of financial penalties and mandated operational changes signals a shift toward stricter accountability for automakers. The company must now demonstrate that it can effectively manage consumer trust while maintaining the functionality of its connected vehicle services and data-driven programs.