GM reaches $220M settlement over selling drivers’ private data
As part of the settlement, GM must get drivers’ express consent before it collects or shares their driving and location data.
Key points
- GM will pay $220 million to 36 states over allegations it sold drivers' private data.
- The settlement requires GM to obtain express consent before collecting or sharing driving and location data.
- GM must have a third party assess its compliance with its privacy program.
General Motors has agreed to pay $220 million to 36 states to settle allegations that it illegally sold private driving behavior and location information to data brokers. The agreement was announced Thursday and settles a lawsuit brought by a coalition of attorneys general from the 36 states.
The suit alleged GM sold the information to data brokers, which then sold it to insurance providers. Under the settlement, GM must obtain drivers' express consent before collecting or sharing their driving and location data, terms in line with earlier agreements with California and the Federal Trade Commission.
New compliance requirement
The multi-state settlement adds a requirement not included in the earlier deals: GM must have a third party assess its compliance with the privacy program it has put in place.
The agreement follows a New York Times report more than two years ago on how GM and OnStar collected, used and sold precise geolocation and driving behavior data through the Smart Driver program. GM discontinued Smart Driver in 2024, and in January the FTC finalized an order barring GM and OnStar from sharing certain consumer data.
This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices
— GM
What GM says
GM said the agreement addresses Smart Driver and reinforces steps it has taken to strengthen its privacy practices. The company said it will no longer sell vehicle information that can be linked to an individual, their vehicle location or how they drive, though it may still share anonymized data not tied to an individual with certain partners.
GM has also updated its privacy policy language and created a consumer-facing Privacy Center.
