General Motors will pay $220 million to settle allegations that it sold customers' private driving behavior and location data to third parties, including data brokers who then resold the information to insurance companies. Connecticut Attorney General William Tong announced the settlement, saying his office found that GM's data collection affected 123,143 people in Connecticut, who will see the state receive more than $6 million through the deal.
The case centers on GM's Smart Driver program, which the automaker pitched to customers as a way to improve driving safety. According to Tong, GM instead enrolled millions of drivers between 2016 and 2024 and tracked their habits, then sold that information to data brokers under contracts that specified the data would be used for insurance products. As reported by WFSB, Tong helped lead a coalition of 36 attorneys general in the case against GM, and more than 10,283,000 Americans were impacted by GM's illegal data collection and sale practices.
What GM Told Drivers Versus What It Did
Tong's office found that GM told drivers it would not share their data with insurers without express consent, and never disclosed that the information would actually be sold for insurance purposes. Data brokers who received the information sold it to insurance companies, which could then use the driving habits to change customers' premiums, according to the Vermont attorney general's office, which separately announced its own settlement with GM over the same practices. The data in question included the number of drives a customer took, each trip's start and end times, instances of quick braking or acceleration, and speeding, per Tong's findings.
Tong did not mince words about what the arrangement amounted to. “GM turned private vehicles into mobile insurance surveillance machines without consumer consent or awareness,” he said, according to WFSB. He added that “GM profited from the sale of this personal driving data, and consumers paid the price in the form of higher premiums.”
Thousands Mistakenly Told They Weren't Enrolled
The scope of the problem went beyond disclosure failures. The OnStar app mistakenly told more than 370,000 drivers nationwide that they were not enrolled in Smart Driver when they actually were, according to Vermont Business Magazine. That detail, drawn from the multistate investigation, compounds the consent problems regulators say GM created by enrolling customers in the program in the first place.
In Connecticut, Tong said the GM probe was among the state's first actions under the Connecticut Data Privacy Act, and the state began investigating GM and issued an initial notice of violation in 2024. The settlement requires GM to obtain consumers' affirmative express consent before collecting or disclosing driving and location data going forward, limit the amount of driving data it gathers, and protect personal information through a comprehensive privacy program, per the multistate agreement described by Vermont officials.
GM Says It Already Shut Down the Program
A GM spokesperson said the agreement addresses Smart Driver, which the company says it ended in 2024, and that it reinforces improvements already made to its privacy practices. GM has said separately that it discontinued Smart Driver across all its vehicles, unenrolled all customers, and ended its third-party telematics relationships with data brokers LexisNexis and Verisk. Tong's office says GM discontinued the program after media reporting exposed the practices. Ars Technica had previously reported that GM stopped sharing OnStar Smart Driver customer data with LexisNexis and Verisk as of March 20, 2024.
The Connecticut settlement is not the only action GM has faced over the practice. California separately reached a $12.75 million settlement with GM in May, which included a five-year ban on selling personal data to brokers and restrictions on how GM uses driving data collected from OnStar subscribers, subject to court approval, according to Reuters. California investigators said GM made roughly $20 million nationwide from the data sales. The Federal Trade Commission also finalized an order in January requiring GM and OnStar to obtain affirmative express consent before collecting, using, or sharing connected-vehicle data, with that order lasting 20 years.
A Problem Bigger Than One Automaker
GM is far from alone in collecting this kind of information. Consumer Reports has found that nearly every automaker selling cars in the United States similarly collects and shares driver behavior data with other companies, a practice made easier by internet-connected onboard computer systems that can capture detailed speed and braking information. The nonprofit notes that driving data often ends up in the hands of multiple companies and can be used to influence insurance premiums and auto loan terms offered to consumers online.
