General Motors has agreed to a $220 million settlement with a coalition of 36 state attorneys general following allegations that the automotive giant improperly sold customer driving habits and location tracking data to third-party data brokers. The legal action focused on GM’s now-defunct Smart Driver initiative, a connected car program that gathered granular vehicle telemetry—including speed, braking patterns, acceleration, and seatbelt usage—and transferred the records to data brokers like LexisNexis and Verisk. These brokers then sold the metrics to commercial auto insurance providers, ultimately causing unexpected premium increases for drivers without their knowledge or clear consent.

Under the binding terms of the new agreement, GM is mandated to establish robust privacy protections and secure express, opt-in consent from drivers before collecting, storing, or sharing any personal telemetry or geographic location details. While building upon prior regulatory mandates from state and federal consumer protection agencies, this latest settlement introduces a key enforcement layer: GM must contract an independent third-party auditor to evaluate and verify its data privacy compliance program on an ongoing basis. The automaker officially ended the Smart Driver feature in early 2024, revised its privacy policies, and launched a dedicated online portal for consumer privacy settings.

While GM has pledged to end the sale of vehicle information linked directly to specific individuals or locations, the company noted that anonymized and aggregated driver datasets may still be shared with enterprise partners. The resolution comes at a crucial moment as vehicles become increasingly computerized and equipped with high-powered sensors, external cameras, and cloud-connected software. As GM deploys new features like artificial intelligence assistants and live recording services across its OnStar ecosystem, privacy advocates stress that clear boundaries and user control must remain central to the connected vehicle revolution.

Key Takeaways

• GM will pay $220 million to 36 states over allegations it covertly sold driver behavior and location data to insurance brokers.
• The settlement mandates explicit opt-in driver consent and obligates GM to undergo independent third-party privacy audits.
• GM has shut down its Smart Driver feature and launched a Privacy Center, though anonymized vehicle data may still be shared.

Editor’s Analysis & Impact

This $220 million settlement marks a pivotal moment in regulatory oversight for connected vehicle technology. As modern automobiles transform into mobile computing platforms packed with sensors and telematics, automakers have sought to create lucrative revenue streams by monetizing driver data. However, this legal outcome sends a clear warning to the automotive sector: monetizing telemetry without transparent, explicit consumer permission carries severe legal, financial, and reputational penalties. Moving forward, trust will serve as a key brand differentiator. Companies introducing AI assistants and advanced camera features must prioritize rigorous encryption, clear opt-in permissions, and strict data governance over short-term data brokerage profit.

Frequently Asked Questions

Q: Why did General Motors face legal action over driver data?
A: GM was sued for gathering detailed driving telemetry and location data through its Smart Driver feature and selling it to data brokers, who subsequently shared it with insurance companies to adjust driver rates.

Q: What changes must GM implement following the settlement?
A: GM must obtain explicit driver consent before collecting or sharing driving metrics, update its privacy controls, and submit to regular compliance assessments conducted by an independent third-party auditor.

Q: Is GM allowed to share any driving data in the future?
A: GM can no longer sell identifiable personal driving or location data, but the company retains the right to share anonymized or aggregated metrics that cannot be linked back to individual drivers or specific vehicles.