GM Settles $220M Lawsuit Over Unauthorized Driver Data Sales
General Motors faces strict privacy mandates after selling customer driving habits to insurers.
1Massive Settlement Reached
General Motors agreed to pay $220 million to 35 states and the District of Columbia. This settlement resolves a major privacy lawsuit regarding the Smart Driver program, which operated from 2016 to 2024. The company faced allegations of selling driver location and habit data to insurance providers without obtaining proper consumer consent.
2Impact on Insurance Premiums
The investigation revealed that driving habits collected by GM were shared with data brokers and subsequently used by insurance companies to adjust rates. Some drivers experienced significant premium increases, with one reported case showing a 22% hike directly linked to data supplied by the automaker. This practice triggered widespread regulatory scrutiny.
3Regulatory and Legal Consequences
Following the 2024 investigation, GM terminated the Smart Driver program. In 2025, the company reached a separate settlement with the Federal Trade Commission, resulting in a five-year ban on selling driver data. The current multi-state agreement mandates that GM must obtain affirmative express consent before collecting or disclosing any future consumer data.
4Corporate Privacy Policy Shifts
GM claims to have strengthened its internal privacy practices since the program ended. The company has simplified its US privacy statement, launched a dedicated Privacy Center for consumers, and enhanced internal controls for connected vehicle data. A spokesperson emphasized that GM is now committed to being clear about what information is shared.
5Cars as Data Hubs
Modern automobiles function as computers on wheels, collecting vast amounts of information including location, diagnostic data, and even contact lists. The primary issue for GM was not the collection itself, but the breach of trust regarding the sale of this information. Manufacturers now face pressure to align data practices with consumer expectations.
6Industry-Wide Privacy Concerns
Legal experts suggest that while GM was the most egregious case, selling driving data is an industry norm rather than an aberration. With a $220 million settlement now established as a template, regulators have a clear precedent for future enforcement actions. Other automakers should expect increased scrutiny regarding their own data collection methods.
7Security Architect Perspectives
Security experts like Clyde Williamson note that modern cars carry privacy risks similar to smartphones but often lack the same level of manufacturer security scrutiny. Drivers currently have limited control over what data is transmitted to manufacturers. Protecting personal information remains difficult without sacrificing the convenience of modern connected vehicle features.
8Consumer Data Protection Steps
To mitigate risks, experts advise drivers to opt out of data sharing whenever possible and avoid unnecessary permissions. Consumers should review their Customer Disclosure Reports to monitor what information is being tracked. If a vehicle features a removable modem, disabling it remains one of the few ways to truly restrict background data transmission.
Original article: CNET — GM Settles $220M Lawsuit Over Unauthorized Driver Data Sales