General Motors has reached a $220 million settlement with 36 U.S. states over accusations that it unlawfully sold driver behavior and location data through its Smart Driver program. Under the agreement, GM must obtain explicit consent from drivers before collecting or sharing sensitive driving data, aligning its policies with prior settlements in California and an order from the Federal Trade Commission.
The multi-state lawsuit charged GM with distributing precise geolocation and driving behavior data—collected via its Smart Driver feature—to data brokers such as LexisNexis and Verisk. These brokers allegedly passed this information to insurance companies, potentially influencing rates based on behavior and location. GM shut down Smart Driver in 2024 after investigative reporting revealed its data practices.
Key Provisions: Consent, Oversight, Transparency
The new settlement requires GM to secure drivers’ explicit permission before collecting or sharing data tied to individuals, their vehicles, or their driving patterns. An independent third party will also regularly audit GM’s compliance with its updated privacy program. While individual-linked data is off-limits under the agreement, GM can still share anonymized datasets under restricted circumstances.
GM has also revised its privacy policy and launched a consumer-focused “Privacy Center” to clarify how data is collected, stored, and shared. These actions mirror those stipulated in a separate order from the FTC finalized earlier this year, which placed similar restrictions on GM and its OnStar telematics service to protect consumer privacy.
Broader Context: Emerging Risks in Connected Vehicles
This settlement arrives amid growing concerns about privacy in the automotive industry, especially as vehicles become increasingly sensor-rich and software-driven. Automakers are now integrating services like AI-powered assistants into their platforms—GM is introducing a voice-enabled AI assistant in OnStar that taps into the vehicle’s cameras for live views, crash detection, and expanded safety features. These developments heighten questions about how driving data will be handled going forward.
GM emphasizes that recordings and location data collected by these new features are encrypted, time-limited, and under customer control. Still, customers who opt out of data-sharing may face limitations in the services they can access.
Analytically, this settlement marks a turning point for privacy norms in the automotive sector. As vehicles become more like mobile computers and repositories of personal data, companies will face increasing legal, regulatory, and consumer pressure to treat driver data with greater respect. What GM’s deal illustrates is the rising cost of failing to build privacy-first systems from the ground up.
