General Motors will pay 220 million dollars to settle a multistate lawsuit alleging it illegally sold private driving behaviour and location information to data brokers, who in turn sold it to insurance providers. The coalition comprised the attorneys general of 35 states and the District of Columbia, described in some state announcements as 36 attorneys general in total.
The data came from Smart Driver, a free feature inside GM’s connected car apps that tracked and rated hard braking, late night driving, speeding and seat belt use, alongside precise geolocation. The states alleged that from 2016 to 2024 millions of drivers were enrolled without being told their data would be sold for insurance purposes, and that more than 370,000 drivers were told by the OnStar app that they were not enrolled when they were. The brokers named in the original reporting were LexisNexis and Verisk.
Under the settlement GM must obtain drivers’ express consent before collecting or sharing their driving and location data, consistent with its earlier agreements with California, where it paid 12.75 million dollars in May, and with the Federal Trade Commission, whose January order bans GM and OnStar from sharing certain consumer data with consumer reporting agencies for five years. The new element is oversight: a third party must assess GM’s compliance with its privacy programme. GM said the agreement addresses Smart Driver, a product it ended in 2024, and that it no longer sells vehicle information linked to an individual.
Texas, which sued GM separately in 2024, is not part of this settlement and its case continues. For the rest of the industry the template is now set: connected vehicle data is treated as consumer data with consent duties attached, and the enforcement route runs through state attorneys general as much as through the federal regulator.