GM Pays $220 Million to Stop Selling Driver Data

General Motors agreed to pay $220 million to resolve allegations that it sold private driver behavior and location data to third parties without proper permission. The multistate settlement addresses a period from 2016 to 2024 when the automaker collected detailed driving habits through its Smart Driver program. This program was marketed to consumers as a tool to improve safety, yet the data flowed to data brokers and insurance companies.

Hawaii is part of a coalition of 36 attorneys general involved in the case. The state will receive $2,861,340 from the total payout. Mana Moriarty, executive director of the Hawaii Office of Consumer Protection, said the settlement ensures companies are held accountable for collecting information without customer knowledge. She noted that Hawaii consumers deserve control over their personal data.

The core issue involves how GM handled enrollment in the Smart Driver program. Most customers signed up at dealerships when purchasing vehicles. GM used a single sign-up process for both Smart Driver and its OnStar services. The coalition found that dealership employees often accepted terms and conditions on behalf of customers without their explicit consent. Dealerships had strong financial incentives to maximize enrollment, with sales employees receiving bonuses based on the number of customers signed up for connected vehicle services.

GM told drivers that it would not share their data with insurers without express consent. However, contracts with data brokers specified that the data could be used for insurance products. These brokers sold the information to insurance companies, which then used it to adjust premiums. Drivers did not receive disclosure that their data would be sold for this specific purpose. The data included identifiable details such as the number of drives, start and end times, instances of hard braking or acceleration, and speed limit violations.

Internal errors at GM compounded the issue. The OnStar app incorrectly informed more than 370,000 drivers that they were not enrolled in Smart Driver. In reality, the company was actively collecting and selling their data. GM later unenrolled these drivers quietly without notifying them of the mistake. The company left the previously collected data with the data brokers and insurance firms.

The New York Times documented how insurance companies used this data to change rates, sometimes increasing premiums. Following the report, GM discontinued the Smart Driver program. The settlement now mandates that GM obtain affirmative, express consent from consumers before collecting or disclosing driving and location data. The agreement also requires the automaker to limit the amount of driving data it collects and protect personal information under a comprehensive data privacy program.

The terms secured by the coalition include internal and external assessments of data protection and privacy programs. GM must also implement oversight and training requirements at its dealerships to prevent unauthorized enrollment. The case was co-led by Washington and Oregon, with assistance from the Executive Committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont.

Other participating jurisdictions included Alabama, Alaska, Arizona, the District of Columbia, Florida, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, Wisconsin, and the Hawaii Office of Consumer Protection. The settlement represents a coordinated effort to standardize consent requirements across state lines.