GM to Pay $220 Million After Selling Drivers' Driving Data to Insurers

General Motors has agreed to pay $220 million to 36 states, closing a case that accused the automaker of quietly selling drivers’ location and behavior data to brokers who passed it on to insurance companies.

The settlement, announced Thursday by a coalition of state attorneys general, forces GM to obtain explicit customer consent before collecting or sharing driving and location information. It’s the largest financial penalty yet from the fallout over GM’s Smart Driver program — a free feature inside its connected-car apps that rated how people drove and whether they buckled up.

What GM Actually Sold

The mechanics of the scheme are what made it so uncomfortable. Smart Driver data didn’t stay inside GM’s ecosystem.

• Data brokers such as LexisNexis and Verisk bought the records
• Insurers then purchased that information, potentially affecting individual premiums
• Opt-in was opaque, according to the multi-state complaint

A New York Times investigation more than two years ago first exposed how GM and its OnStar telematics unit handled precise geolocation and driving-behavior data. That report triggered the regulatory avalanche that has now landed.

The Cost: $220 million across 36 states · Third-party compliance audits now mandatory · Smart Driver discontinued in 2024

A New Twist: Outside Auditors

Most of the terms mirror deals GM already struck with California and the Federal Trade Commission, which finalized an order in January barring the company and OnStar from sharing certain consumer data. But this settlement adds something fresh — GM must bring in an independent third party to verify it’s actually following its own privacy program.

GM framed the outcome as a housekeeping matter. “This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” the company said in an emailed statement, adding that connected-vehicle data enables “safer, more helpful and personalized experiences.”

The automaker says it will no longer sell information that can be tied to an individual, their vehicle’s location, or their driving habits. Anonymized data that can’t be linked back to a person may still go to partners. GM has also rewritten its privacy policy and stood up a consumer-facing Privacy Center.

Why This Lands Now

Modern cars are rolling sensor platforms, and automakers have poured money into software-defined vehicles that sync with calendars, messages and email. GM itself is bolting a personal AI assistant onto OnStar, its 30-year-old safety and roadside service. Cameras tied to that system will offer live views plus crash and safety recordings, with voice control for climate and other functions.

When GM unveiled the assistant at its October GM Forward event, it stressed privacy safeguards: users choose what’s shared, recordings are encrypted and time-limited, and neither GM nor OnStar can access Connected Camera footage. The catch — decline to share and some features get walled off.

That trade-off is now the industry’s central question. Regulators have made clear that consent has to be real, not buried in a settings menu. For drivers, the practical result is simple enough: fewer quiet handoffs of their habits to whoever is willing to pay.