GM Agrees to $220 Million Settlement Over Alleged Sale of Drivers’ Personal Data
General Motors (GM) has agreed to pay $220 million to settle allegations that it improperly sold customers’ personal information and driving behavior data to third parties, including data brokers and insurance companies.
The settlement involves a coalition of attorneys general from 36 U.S. states. According to investigators, GM collected drivers’ location information and driving habits, then shared the data with third parties that subsequently sold it to insurance companies. Insurers allegedly used the information to assess driving behavior and determine customers’ insurance premiums.
However, GM failed to adequately inform drivers that their personal information could be sold and used for insurance-related decisions, the Washington State Attorney General’s Office said in an October 29 statement.
Washington and Oregon jointly led the investigation. GM has now reached an agreement with all 36 participating states.
According to the lawsuit filed by Washington State, GM collected driving behavior information through its Smart Driver feature. The data included hard braking, speeding beyond designated thresholds, rapid acceleration, seat belt usage, and late-night driving.
GM promoted Smart Driver as a feature designed to help customers improve their driving skills. However, the company allegedly failed to disclose that the information could be shared with third parties for commercial purposes.
The lawsuit also raised concerns about location data collected through GM’s OnStar service. This information was reportedly connected to personally identifiable details, including customers’ names, addresses, and vehicle identification numbers.
Washington accused GM of violating the state's Consumer Protection Act, which prohibits unfair and deceptive business practices. Oregon separately alleged violations of its Unlawful Trade Practices Act.
Under the settlement, Washington State will receive $12.3 million, while Oregon will receive more than $10.4 million. The remaining amount will be distributed among the other participating states.
“People bought a car, not a tracking device,” Oregon Attorney General Rayfield said in a statement on October 29.
He said GM had promoted the program as a way to help drivers become safer on the road and had promised not to share their information with insurers without permission.
However, the investigation found that GM sold the data anyway, potentially causing some customers to face higher insurance premiums.
Rayfield said the settlement would help restore consumers’ control over their personal information.
GM Discontinued Smart Driver Program in 2024
GM announced in 2024 that it was discontinuing its Smart Driver program amid growing concerns over customer privacy and the use of driving data.
The lawsuits named General Motors LLC, General Motors Holdings LLC, and OnStar LLC, all subsidiaries of General Motors Company.
Under the settlement agreement, GM has not admitted to violating any local, state, or federal laws and has accepted no liability.
A GM spokesperson told Reuters that the agreement reinforces other measures the Detroit-based automaker has taken to strengthen customer privacy protections.
The spokesperson said connected vehicle data could support safer, more useful, and personalized driving experiences. However, the company remains committed to explaining what information it collects, how that information is protected, and what choices customers have regarding data sharing.
As part of the agreement, GM will face restrictions on how it collects and uses driver information. The company is also prohibited from selling such data to data brokers for five years.
Previous Settlement With California
GM had previously reached a separate settlement with California over similar allegations. California was not among the states involved in the latest multistate case.
In May, California Attorney General Rob Bonta announced that GM had agreed to pay $12.75 million in penalties over the alleged unlawful sale of location and driving behavior data belonging to hundreds of thousands of California residents.
The announcement followed an investigation into the company's handling and sharing of customer information.