General Motors to pay $220 million to settle allegations of improper driver data collection and sale

General Motors, the Detroit-based automotive giant, has reached a significant $220 million settlement with 36 states and the District of Columbia to resolve allegations that the company improperly harvested and sold personal driving data to third-party insurance providers. The agreement concludes a long-running multi-state investigation into the automaker’s “Smart Driver” program, which critics and regulators argued led to the clandestine sharing of sensitive consumer information, ultimately resulting in increased insurance premiums for unsuspecting motorists.

The settlement marks a pivotal moment in the ongoing national debate regarding data privacy in the era of the “connected car.” As vehicles have evolved into sophisticated computers on wheels, the boundary between automotive functionality and consumer surveillance has increasingly blurred, prompting heightened scrutiny from state attorneys general and federal regulators alike.

A Decade of Data Harvesting

The investigation, spearheaded by the attorneys general of Washington and Oregon, focused on the period between 2014 and 2024. During this decade, General Motors enrolled millions of drivers into its Smart Driver program. The program was designed to track driving habits—such as acceleration, braking patterns, speed, and the specific timing of trips—under the guise of promoting safer driving habits.

According to the findings released by the Washington Office of the Attorney General, the automaker misled consumers regarding the scope of data usage. While GM’s marketing materials suggested that the data would be used to help drivers improve their safety behind the wheel, the company simultaneously shared that data with data brokers and insurance carriers without obtaining explicit, informed consent from the vehicle owners.

For many customers, the enrollment process was opaque. The investigation revealed that during the vehicle purchase process at dealerships, employees often enrolled customers in the Smart Driver program without their clear knowledge or permission. This practice was reportedly incentivized by internal GM policies that provided bonuses to dealership staff based on the volume of enrollments, creating a financial motive to bypass rigorous consent procedures.

Systemic Failures and the OnStar Misstep

The scope of the mismanagement extended beyond the dealership floor. A significant technical failure within the OnStar mobile application—a cornerstone of GM’s connected services—wrongly informed approximately 370,000 drivers that they were not enrolled in the Smart Driver program, when in fact they were.

In a move that further frustrated consumer advocates, GM reportedly unenrolled these drivers following the discovery of the internal error but failed to notify them of the change. Crucially, while the data collection stopped, the automaker allowed third-party data brokers to retain the information already harvested, effectively leaving the personal driving history of those hundreds of thousands of individuals in the hands of third parties without the drivers’ awareness or authorization.

Washington Attorney General Nick Brown emphasized the gravity of the situation in a public statement, noting that the data belonged to the citizens and that their right to privacy had been compromised. “Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used,” Brown stated. “We’re proud to lead this bipartisan agreement holding GM accountable for misusing drivers’ data.”

Chronology of the Regulatory Crackdown

The resolution of this case follows a mounting wave of regulatory pressure that began in earnest around 2024. The following timeline highlights the key developments in the scrutiny of General Motors’ data practices:

• 2014–2024: The active period of the Smart Driver program, during which millions of drivers were enrolled, often without explicit consent.
• April 2024: Following intense media scrutiny and reports from outlets like The New York Times, General Motors officially terminated the Smart Driver program.
• 2024: Texas initiated a lawsuit against the automaker, alleging violations of state privacy laws related to the collection and sale of driver telemetry.
• Late 2024: Multiple state investigations coalesced into a unified, bipartisan coalition of 36 states and the District of Columbia.
• January 2025: The U.S. Federal Trade Commission (FTC) issued a landmark ban, prohibiting the automaker from selling sensitive driver data to third parties, a move that significantly curtailed the company’s data monetization strategy.
• Early 2025: GM reached a separate $12.75 million settlement with the state of California, a precursor to the broader, national settlement finalized shortly thereafter.

The Financial and Operational Cost

The $220 million payment is only one facet of the resolution. As part of the consent decree, General Motors has agreed to a comprehensive overhaul of its data privacy infrastructure. This includes the implementation of rigorous internal and external privacy protection assessments, which will be subject to oversight by the participating states.

Moving forward, GM is mandated to obtain "affirmative express consent" from every consumer before any driver data can be collected or shared. The company is also required to provide better training to dealership staff to ensure that customers are fully informed about what they are signing up for when they activate connected vehicle services.

Furthermore, GM has terminated its partnerships with major data brokers, including LexisNexis and Verisk, which were the primary entities receiving the driving telemetry for the purpose of adjusting insurance risk profiles. This severance of ties signifies an industry-wide shift away from the once-lucrative practice of selling driver behavior data to the insurance industry.

Broader Implications for the Automotive Industry

The settlement serves as a warning shot to the entire automotive sector. Modern vehicles are equipped with an array of sensors, cameras, and GPS modules that generate vast amounts of data. This "data exhaust" is highly valuable to insurers, marketers, and urban planners, creating a massive secondary market.

However, the GM case illustrates that the public is increasingly sensitive to how this information is used. The direct link between the data sold by the automaker and the subsequent increase in insurance premiums for drivers created a tangible harm that catalyzed public and political outrage.

For car enthusiasts and everyday drivers, the incident raises fundamental questions about the future of vehicle connectivity. While connected features like remote start, vehicle diagnostics, and emergency assistance (such as OnStar) offer convenience and safety, the trade-off is the constant transmission of personal location and behavior data. The legal consensus emerging from this settlement is that such connectivity cannot come at the expense of consumer autonomy.

Industry Analysis: A Turning Point

The automotive industry has spent the better part of the last decade pivoting toward a “software-defined vehicle” business model. Automakers have long viewed recurring revenue from data and subscription services as a critical pillar of their future profitability, especially as electric vehicle (EV) margins remain compressed.

However, the aggressive pursuit of this revenue stream—without adequate disclosure—has proven to be a strategic misstep. The reputational damage and the legal costs associated with these investigations have forced companies like GM to re-evaluate their data strategies. Analysts suggest that the era of "stealth data collection" is effectively over, as state-level privacy legislation, such as those in California and beyond, gains momentum.

Moving forward, the industry will likely be forced to adopt a "privacy-by-design" approach. This involves limiting data collection to what is strictly necessary for vehicle functionality and providing consumers with granular control over their information. Companies that fail to adapt to this new standard will likely face further litigation, as state attorneys general become increasingly sophisticated in their understanding of telematics and data brokering.

The GM settlement is not merely a penalty; it is a framework for how the industry must operate in a digital-first economy. By forcing one of the world’s largest automakers to pay a substantial sum and submit to external oversight, regulators have signaled that the privacy of the driver is a non-negotiable component of the modern vehicle ownership experience.

As the industry continues to integrate Artificial Intelligence and autonomous driving technologies, the volume of data generated by vehicles will only increase. Whether the manufacturers can balance the technical benefits of this data with the fundamental rights of the consumer will remain the defining challenge for the automotive sector in the coming decade. For now, the $220 million settlement stands as a stark reminder that in the race to digitize the road, the consumer’s consent is the most critical piece of equipment on board.