GM to pay $220M to settle claims it sold driver data

The claims arose from the automaker's now-discontinued Smart Driver program that tracked driver behavior.SEATTLE (CN) — General Motors agreed Thursday to pay $220 million to end a multistate lawsuit in which the automaker is accused of selling private driving behavior and location data to data brokers.“People bought a car, not a tracking device,” Oregon Attorney General Dan Rayfield said in a statement.Oregon and Washington led a coalition of 36 attorneys general that brought claims against the automaker. After launching an investigation, they say they found GM had been misusing the data it collected through its Smart Driver program.Millions of drivers enrolled in GM’s Smart Driver program between 2016 and 2024, with a majority of customers doing so at the GM dealership when they bought their vehicle. Drivers could enroll in the program along with OnStar, GM’s subscription-based security and safety service.The attorneys general say the automaker was heavily incentivizing dealerships to sign up as many people as possible for OnStar, giving sales employees bonuses partially based on how many customers signed up for GM’s vehicle services and ranking dealerships based on their enrollment numbers.But the attorneys general say GM’s systems didn’t notify drivers about whether their data was being tracked.The attorneys general said the data GM collected and sold was personal, identifiable and specific. They also said GM sold consumer information to data brokers under contracts that specified the data were to be used for insurance products.“GM told drivers this program would help them drive more safely and promised it wouldn’t share their data with insurers without permission,” Rayfield said. “Our investigation found GM sold that data anyway, and some drivers paid for it with higher premiums. This settlement puts people back in control of their own information.”According to the attorneys general, the OnStar app told 370,000 drivers they were not enrolled in the Smart Driver program when they were enrolled and actively having their data collected and sold by GM. The attorneys general say GM later quietly unenrolled those drivers without informing them of the mistake but left their data with insurance companies and data brokers.Insurance companies could see exactly when a driver started a trip, how many times they drove, how often they braked and whether they were speeding or not. Sometimes, this information was used to change insurance rates, according to the attorneys general.Under the terms of the settlement, GM must obtain affirmative express consent from consumers before it collects or discloses their driving and location data. It also must limit data collection to only what is relevant and necessary to fulfill the specific purpose for which it was collected.A GM spokesperson said the company discontinued the Smart Driver program in 2024, and the settlement reinforces the steps the automaker has taken to address privacy practices.“Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected and the choices customers have about what they share,” the spokesperson said in an email.The automaker also said it doesn’t sell vehicle information that can be linked to an individual, though it may disclose data not associated with specific drivers or vehicles to certain partners, such as to enhance city infrastructure.The terms of the settlement also mandate that GM undergo internal and external data protection and privacy program assessments. The automaker also agreed to oversight and training requirements at its dealerships to make sure customers are not being enrolled in data collection programs without consent.“Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used,” Washington Attorney General Nick Brown said in a statement. “We’re proud to lead this bipartisan agreement holding GM accountable for misusing drivers’ data.”The $220 million will be divided among the states, and Washington will receive $12.3 million to cover the costs and attorney fees associated with the case.The other states that joined the suit include Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont. They were joined by the attorneys general of Alabama, Alaska, Arizona, the District of Columbia, Florida, Hawai’i, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia and Wisconsin.“Today’s settlement holds GM accountable and clearly lays out the state’s expectations for compliance with our privacy laws as car companies roll out new technology,” Colorado Attorney General Phil Weiser said in a statement.Subscribe to our free newslettersOur weekly newsletter Closing Arguments offers the latest about ongoing trials, major litigation and rulings in courthouses around the U.S. and the world, while the monthly Under the Lights dishes the legal dirt from Hollywood, sports, Big Tech and the arts.Additional Reads