General Motors will pay $220 million to 36 states to settle allegations that it illegally sold private driving behavior and location information to data brokers, according to the settlement announced Thursday.
The coalition of state attorneys general alleged that GM sold the information to data brokers, which in turn sold it to insurance providers. The settlement resolves that lawsuit.
Under the agreement, GM must obtain drivers' express consent before it collects or shares their driving and location data. The terms are in line with separate agreements GM previously reached with California and the Federal Trade Commission. The settlement also requires a third party to assess GM's compliance with its privacy program.
The settlement follows a New York Times report from more than two years earlier. That report said GM and OnStar collected, used, and sold drivers' precise geolocation data and driving behavior to third parties, including data brokers LexisNexis and Verisk. The data came from GM's Smart Driver program, a free feature in its connected car apps that tracked and rated driving behavior and seatbelt use. According to the NYT, data brokers sold the information to insurers, which could affect customers' rates.
GM discontinued Smart Driver in 2024. In January, the FTC finalized an order that bars GM and its OnStar telematics service from sharing certain consumer data. The FTC order and the multistate settlement both require GM to be more transparent and to obtain explicit consent for certain data collection.
In an emailed statement, GM said the agreement "addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices." GM said it will no longer sell vehicle information that can be linked to an individual, their vehicle location, or how they drive. It may still disclose anonymized data not tied to an individual with certain partners. GM also said it updated its privacy policy and created a consumer-facing Privacy Center.