General Motors to pay 220 million dollars to settle multistate litigation over the unauthorized sharing of driver data
General Motors has reached a landmark 220 million dollar settlement with a coalition of 36 attorneys general representing 35 U.S. states and the District of Columbia. The agreement concludes a protracted legal battle concerning the automaker’s practices regarding the collection and subsequent sale of sensitive driving and location data to third-party brokers and insurance companies. Under the terms of the settlement, which was finalized this week, the automotive giant is now legally mandated to obtain explicit, informed consent from vehicle owners before gathering or sharing any telemetry, behavioral, or location-based information.
The coalition, co-led by the Attorneys General of Washington and Oregon, argued that GM’s OnStar and "Smart Driver" programs effectively transformed consumer vehicles into clandestine tracking devices. As part of the resolution, Washington will receive approximately 12.3 million dollars, while New York is set to secure 12.1 million dollars. The funds are earmarked for state consumer protection efforts and the coverage of investigative costs.
A Chronology of the Data Collection Controversy
The origins of the dispute trace back to 2015, when General Motors introduced the Smart Driver feature as an optional component of its OnStar suite. Marketed primarily as a safety-oriented tool designed to provide drivers with feedback on their habits, the program tracked a granular list of metrics, including hard braking, rapid acceleration, aggressive cornering, seat belt usage, and high-speed maneuvers.
However, the legal filings suggest that the intent behind the data collection quickly expanded beyond safety analytics. According to the complaint filed by the Oregon Department of Justice, GM began selling aggregated and identifiable data to Verisk Analytics as early as 2015, followed by a similar high-stakes partnership with LexisNexis Risk Solutions in 2019. These brokers processed the raw telemetry into "driving scores," which were then sold to insurance carriers. These carriers, in turn, utilized these secret profiles to adjust insurance premiums for unsuspecting drivers.
The issue reached a boiling point in March 2024 following an investigative report by The New York Times, which detailed how a Chevrolet Bolt owner saw his insurance premiums spike by 21 percent due to a LexisNexis report containing 640 distinct trips tracked over a six-month period. The resulting public outcry prompted GM to terminate the Smart Driver program in April 2024. This settlement follows a series of regulatory actions, including a 12.75 million dollar settlement in California in May 2024 and a final order from the Federal Trade Commission in January 2025, which banned GM from sharing specific driver data with consumer reporting agencies for a five-year period.
Mechanical Exploitation: The Role of Dealerships
A critical component of the states’ case involved the aggressive enrollment tactics employed at the point of sale. The attorneys general alleged that General Motors incentivized dealership staff through performance-based bonuses tied directly to the number of customers enrolled in the Smart Driver program.
The complaint highlights a culture of coercive transparency. Customers who attempted to decline the terms of the OnStar service were frequently warned that doing so would result in the loss of critical safety features, such as automatic crash response and emergency roadside assistance. In many instances, dealership employees allegedly bypassed the consumer entirely, signing off on data-sharing agreements without the owner’s knowledge or explicit authorization.
Furthermore, the integrity of the data was brought into question by a significant technical failure. More than 370,000 drivers were falsely informed via the GM mobile application that they were not enrolled in the Smart Driver program. In reality, these drivers remained active in the system, and their data continued to flow to brokers and insurers without their consent. Even after GM unenrolled these users, their historical data remained in the hands of third parties, a fact that was never disclosed to the affected motorists.
The Scope of Privacy Intrusion
The extent of the data collection was vast, extending well beyond the behavioral metrics of the Smart Driver program. From 2018 onwards, GM vehicles were configured to record precise location data at three-second intervals from the moment the ignition was engaged. By 2019, this location data was appended with a unique identifier that linked every movement directly to a specific vehicle and, by extension, its owner.
This information was licensed to Wejo, a United Kingdom-based connected-car data company. Following Wejo’s financial instability and the subsequent acquisition of its assets by Jacobs Engineering in 2024, the flow of data continued under a new licensing framework. The sheer volume of information—tracking exactly where a person went, how long they stayed, and how they drove to get there—represented a level of surveillance that many privacy advocates argue constitutes a violation of fundamental consumer rights.
"People bought a car, not a tracking device," remarked Oregon Attorney General Dan Rayfield. His sentiment was echoed by Washington Attorney General Nick Brown, who emphasized that the data harvested by GM was "personal, identifiable, and specific," undermining the company’s prior assertions that only anonymous data was being shared.
Industry Implications and Corporate Response
In response to the settlement, General Motors maintained its stance that it did not admit to any wrongdoing. In a statement provided to the media, a company spokesperson stated, "This agreement addresses Smart Driver, a product we ended in 2024." The company further confirmed that it has overhauled its data practices, asserting that it no longer sells vehicle data that can be linked to an individual consumer. GM indicated that while it may continue to share non-identifiable, aggregated data, its current operations are strictly aligned with the mandates imposed by the recent regulatory findings.
The implications for the broader automotive industry are significant. As vehicles become increasingly digitized, the boundary between a consumer product and a data-collection platform has blurred. Other manufacturers are facing similar scrutiny. For instance, Volvo has introduced its own "Safety Coach" app, which provides driving scores that can be shared with insurers—though the company emphasizes user control and transparency.
The regulatory climate is shifting toward stricter oversight. In September, the Irish Data Protection Commission issued a massive 403 million euro fine to Google regarding the mismanagement of location data, signaling that global regulators are moving in lockstep to punish the commodification of movement.
For General Motors, the 220 million dollar payment is only part of the burden. The company is now required to implement a comprehensive data privacy program, subject to rigorous internal and third-party assessments. Furthermore, the company must provide extensive training to dealership staff to ensure that future enrollment processes are transparent and legally sound. Despite this major settlement, the company still faces ongoing litigation from the state of Texas, suggesting that the legal fallout from the Smart Driver program may continue for some time.
The Future of Connected Car Privacy
As automakers race to integrate advanced AI assistants, such as the one currently being developed by GM, the question of data ownership remains paramount. The case of the Smart Driver program serves as a stark reminder of the disconnect between corporate profit models and consumer privacy expectations.
For the average motorist, the settlement serves as both a victory and a warning. While it establishes a legal precedent for transparency, it also highlights the vulnerability of modern vehicle owners in an era of "big data." The shift toward requiring explicit consent is a necessary step, but as the technology continues to evolve, the burden of ensuring privacy will likely continue to fall on regulators and the vigilance of the public.
The 220 million dollar settlement is, in effect, a cost-of-doing-business correction for an industry that historically operated with little oversight. As manufacturers look toward a future of autonomous driving and hyper-connected ecosystems, the lesson of the GM scandal is clear: data privacy cannot be an afterthought, and the commercialization of a driver’s daily life is a line that, once crossed, carries severe reputational and financial consequences. The industry now stands at a crossroads, where the trust of the consumer must be earned through rigorous transparency rather than extracted through opaque terms and conditions.
