General Motors to Pay $220 Million Settlement Over Improper Collection and Sale of Driver Data

General Motors has agreed to a landmark $220 million settlement with 36 states and the District of Columbia to resolve allegations that the Detroit-based automotive giant improperly collected and sold sensitive personal information belonging to millions of drivers. The multi-state agreement marks one of the most significant privacy settlements in the automotive industry to date, highlighting the growing tension between the era of the "connected car" and the fundamental rights of consumers to data privacy.

The settlement concludes a wide-ranging investigation spearheaded by the Attorneys General of Washington and Oregon. The probe centered on the automaker’s “Smart Driver” program, which was marketed to customers as a tool to monitor driving habits and provide feedback to improve road safety. Instead, investigators found that GM utilized the program to harvest granular data—including vehicle speed, braking patterns, and exact GPS location—and subsequently sold that information to third-party data brokers and insurance companies. This clandestine data pipeline ultimately resulted in higher insurance premiums for unsuspecting drivers who were unknowingly flagged as "risky" by algorithms fed with their own vehicle’s telematics.

A Decade of Unauthorized Data Harvesting

The scope of the investigation spanned a decade, from 2014 to 2024. During this period, General Motors enrolled millions of drivers into its data-gathering ecosystem, often during the high-pressure environment of a dealership purchase. The investigation revealed a troubling pattern: dealership employees were frequently incentivized with bonuses to sign customers up for the Smart Driver program, often doing so without providing clear disclosure or obtaining explicit, informed consent.

The data collection was remarkably invasive. By accessing the vehicle’s OnStar telematics system, GM was able to track specific, identifiable driving behaviors. This information was then transmitted to aggregators like LexisNexis and Verisk, which compiled "consumer disclosure reports." These reports were sold to insurers, who used the data to adjust premiums or deny coverage, often without the driver ever realizing that their own car was the primary source of the information used against them.

Beyond the unauthorized enrollments, the investigation uncovered a technical failure that compounded the privacy breach. The OnStar mobile application incorrectly informed approximately 370,000 drivers that they were not enrolled in the Smart Driver program, even when their data was actively being harvested. When GM eventually "corrected" the situation by unenrolling these individuals, it failed to notify the drivers or ensure that the data already in the hands of third-party brokers was purged or anonymized.

Chronology of the Regulatory Crackdown

The downfall of the Smart Driver program was not an overnight event but rather the result of a compounding series of investigations and public revelations.

• 2014–2023: GM operates the Smart Driver program, scaling it to millions of vehicles under the guise of safety, while quietly sharing telematics data with insurance aggregators.
• Early 2024: Investigative reports, most notably by The New York Times, bring the data-sharing practices to light, sparking national outrage and drawing the attention of federal and state regulators.
• April 2024: Following intense public and regulatory pressure, General Motors officially terminates the Smart Driver program.
• Late 2024: Texas files a formal lawsuit against the automaker, alleging violations of consumer protection laws.
• January 2025: The U.S. Federal Trade Commission (FTC) issues a landmark ruling banning GM from sharing certain categories of sensitive driver data with third parties.
• Mid-2025: The $220 million multi-state settlement is finalized, requiring GM to implement stringent new oversight mechanisms.

The Financial and Regulatory Burden

The $220 million settlement represents a major fiscal blow to General Motors, but it is only part of the broader financial impact of these practices. Earlier this year, the company reached a separate $12.75 million agreement with the state of California to resolve similar allegations of privacy violations.

Under the terms of the new multi-state consent decree, GM is required to overhaul its entire approach to data privacy. The company must now implement a “comprehensive data privacy program,” which includes mandatory internal and external audits to ensure compliance. Crucially, the agreement mandates that GM obtain "affirmative express consent" from any consumer before collecting or sharing their driving data. Furthermore, the company must institute rigorous training and oversight requirements for its dealership network to prevent the aggressive, unauthorized sign-up tactics that characterized the previous decade.

Washington Attorney General Nick Brown emphasized the importance of the ruling, stating, "Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used. We’re proud to lead this bipartisan agreement holding GM accountable for misusing drivers’ data."

Broader Implications for the Connected Car Industry

The General Motors case serves as a warning shot to the entire automotive sector. As vehicles become increasingly digitized, they essentially function as "smartphones on wheels," capable of generating massive amounts of telemetry. The industry has long viewed this data as a lucrative secondary revenue stream, capable of offsetting the costs of research and development for electric vehicles and autonomous systems.

However, the GM settlement signals that regulators are no longer willing to allow the "monetization of the commute" to occur without robust consumer protections. Analysts suggest that this ruling will likely force other major manufacturers—many of whom utilize similar telematics systems—to re-evaluate their own data-sharing agreements.

The core issue is one of transparency. Most consumers view their car as a private space, not a tracking device. When that trust is breached, the fallout is not just financial but reputational. By terminating its relationships with major data brokers like LexisNexis and Verisk, GM is attempting to rebuild that trust, but the process of restoring the brand’s image will take time.

The Path Forward

The data privacy landscape for automobiles is rapidly shifting. With the FTC involved at the federal level and state attorneys general acting as the primary enforcers of consumer protection, automakers are entering a new era of accountability. The requirements for "affirmative express consent" are intended to move the industry away from "dark patterns"—design choices that trick users into agreeing to terms they do not fully understand—and toward a model of informed, intentional user choice.

For current and future GM owners, the settlement ensures that their vehicles will no longer be silent contributors to the data-brokerage industry unless they explicitly opt into such a program. The company has committed to a more transparent architecture, though privacy advocates warn that the burden remains on the consumer to stay vigilant.

As the industry pivots toward AI-integrated virtual assistants and highly connected infotainment systems, the lessons from the Smart Driver debacle will be critical. The integration of technology in modern vehicles must prioritize the sovereignty of the driver over the data-harvesting appetites of the manufacturer. While the $220 million payment is a significant penalty, the true cost to General Motors may be the long-term work of proving to its customer base that their privacy is no longer for sale.

This settlement underscores a pivotal shift in the automotive industry: the era of unchecked data extraction from connected vehicles is coming to an end. Whether this leads to a more consumer-centric approach to in-car technology or simply more complex legal disclosures remains to be seen, but the baseline for privacy has been irrevocably raised.