GM’s $220M Payout Shows How Cars Can Secretly Sell Your Driving Data

GM has settled a multi-state suit over selling customer data without consent. Bloomberg/Getty Images General Motors has agreed to pay $220 million to 35 states and the District of Columbia to settle a major privacy lawsuit over the company’s sale of driver data from its Smart Driver program, which dealerships offered to drivers from 2016 to 2024. In 2024, The New York Times published a damning investigation into the program, revealing that, in some cases, data on drivers’ habits could be used by insurance companies to set rates. Some drivers saw significant premium increases after GM sold their driving history, and one owner was told a 22% premium increase resulted from driving information supplied by a data broker, according to a press release from the New York attorney general’s office. The data collection was described as “spying,” and GM quickly ended the program that year. In 2025, GM settled with the Federal Trade Commission over Smart Driver and OnStar location data, agreeing to a five-year ban on selling driver data. Attorneys general in many of the states involved in the $220 million settlement posted announcements about it, including Anthony G. Brown of Maryland. “Without asking permission, General Motors sold its customers’ driving and location data, which, in some cases, was used by insurance companies to set drivers’ rates,” Brown said in a release. “Because of our settlement, GM can no longer prioritize profit over Marylanders’ privacy.” The settlement requires GM to obtain affirmative express consent from consumers before collecting or disclosing consumer driving and location data. In an email to CNET, a GM spokesperson shared a statement saying the company ended its Smart Driver product in 2024 and said it has strengthened its privacy practices since then. “Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” the spokesperson said. The company also told CNET that it has simplified and updated its US privacy statement, created a Privacy Center for consumers and has been “enhancing internal controls for connected vehicle data.” Not the end of the road for auto privacy concerns Automobiles have evolved into computers on wheels over the last few decades, collecting vast amounts of data on drivers, including contacts and song lists, location data and diagnostic information. For GM, the issue was less about collecting data than about breaking its promise to customers that it wouldn’t sell it. There may be more action to come on illegal or unethical data-collection practices in the auto industry. “GM was the biggest case and, in some ways, presented the most egregious set of facts. But collecting and selling driving data is an industry norm, not an aberration,” said Peter Cassat, technology partner at CM Law and a former general counsel for Cox Automotive and New Country Motor Group. “The difference now is that regulators have a template, and every state attorney general has seen a $220 million settlement, so I think we can expect more enforcement actions and settlements,” Cassat said. The settlement, and the orders in place that GM must abide by, are a good start toward promoting best practices toward privacy in the auto industry, Cassat said. “Vehicle providers should ask for driver consent feature by feature in plain English,” he said, not simply prompt buyers to check a box. Protecting your privacy behind the wheel In addition to whatever paperwork you sign when you buy, lease or rent a car, everyday vehicle use can present some data hygiene problems. Privacy issues can ramp up depending on the level of access you grant your smartphone, and how you’re using the car’s location or connectivity features. Beyond the touchscreen on your dashboard, modern vehicles run background systems that transmit data straight to the manufacturer, and drivers have little to no control over what gets collected or who buys it. Protecting your data can be “really tricky,” said Clyde Williamson, a senior security architect at the AI and data security company Protegrity who has spoken out about auto privacy. “Modern cars can carry many of the same privacy risks as our smartphones, potentially without the same level of attention to security from the manufacturer,” Williamson said. Williamson said that while people have started to raise privacy concerns about other smart devices like televisions, automobiles aren’t getting the same scrutiny. And there aren’t a lot of avenues you can go to shield your data in cars without losing key conveniences. “Unfortunately, there isn’t a lot consumers can do,” he said. “Opt out wherever possible and don’t agree to unnecessary data sharing. Review your own Customer Disclosure Report to see whether driving data appears. And if your car has a modem that can be disabled, consider disabling it.” Omar Gallaga has covered technology, digital culture and other topics for outlets including CNET, NPR, Wired, Texas Monthly, MSNBC, Consumer Reports, The Washington Post, the Los Angeles Times, The Atlantic and the Austin American-Statesman, where he was a longtime tech reporter, editor and podcaster. He lives in the Texas Hill Country. See full bio The Latest from Omar GM’s $220M Payout Shows How Cars Can Secretly Sell Your Driving Data The Massive DHS Breach Is Hacktivist Payback for Government Surveillance Reddit Is Adding ‘For You’ and ‘Following’ Feeds