General Motors will pay $220 million to 36 states to settle allegations that it illegally sold private driving behavior and location information to data brokers. The number is large enough to get attention, but the more important question is whether drivers now have real control over data that was taken from them in the first place.
The report describes a system that should alarm anyone who owns a connected car. A New York Times investigation showed that GM and OnStar collected precise geolocation and driving behavior through the Smart Driver program, which tracked and rated driving and seatbelt use. That data went to LexisNexis and Verisk, and then to insurers that could affect customers' rates. A feature presented as free and helpful ended up functioning as a data pipeline that could shape what people pay for insurance. Drivers were not meaningfully informed that their habits were becoming a commodity.
The settlement requires GM to obtain express consent before collecting or sharing driving and location data, and it adds a requirement for a third party to assess compliance with the company's privacy program. Those are sensible terms. But they arrive more than two years after the original reporting, and after GM discontinued Smart Driver in 2024. The company's own statement frames the agreement as addressing a product it had already ended, which invites the conclusion that consent rules came only after exposure and legal pressure. Regulators should not have to chase a practice this sensitive one investigation at a time.
Meanwhile, the industry is moving in the opposite direction. GM is adding a personal AI assistant to OnStar, with cameras connected to software for live views and crash recordings. The company says customers will control what is shared, that recordings are time-limited and encrypted, and that OnStar cannot access camera recordings. Those promises are welcome, but the report also notes that customers who opt out will likely lose access to certain features. That is the bargain consumers are being offered: privacy becomes a premium paid in functionality.
Regulators should require that opt-outs carry no penalty for core safety and insurance-relevant features, that data sales to brokers be banned outright rather than merely disclosed, and that third-party audits be published. Drivers should not have to read a privacy center to learn that their braking and location history has value to someone else.