GM to pay $220 million over illegal sale of driver data

General Motors will pay $220 million to settle a lawsuit brought by New York Attorney General Letitia James and 35 other state attorneys general. The coalition alleged that the automaker illegally sold private driving and location data to brokers who then passed the information to insurance companies.

The settlement includes a payment of $12,054,341 to New York. The funds stem from an investigation into the company's Smart Driver program, which enrolled millions of drivers between 2016 and 2024. More than 700,000 New York drivers participated in the initiative. The program tracked specific metrics including start and end times for each drive, frequency of hard braking, and instances of exceeding the speed limit.

GM marketed the service as a tool for drivers to improve their own safety. The company told consumers it would not share their data with insurers without express consent. The investigation found that GM sold the information to data brokers under contracts specifically designated for insurance products. These brokers subsequently sold the data to insurance companies, which used it to adjust premiums based on individual driving habits.

A New York Times investigation revealed that some drivers faced substantial premium increases after their data was sold. One driver reported a 22 percent increase in their car insurance premium. That increase was attributed to personal driving information provided by a data broker. The driver reviewed a 130 page report from GM that detailed every trip taken over a six month period.

Dealership employees often enrolled customers in Smart Driver and OnStar services during the vehicle purchase process. GM incentivized dealerships to maximize enrollment numbers through bonuses and rankings between 2020 and 2024. The investigation found that some dealership staff accepted terms and conditions on behalf of customers without their consent.

GM's internal systems failed to notify drivers about their enrollment status. The OnStar app mistakenly informed over 370,000 drivers that they were not enrolled in Smart Driver. The company was actually collecting and selling their data. GM later unenrolled these drivers without notice, though the data remained with brokers and insurers.

Under the settlement, GM must limit the driving data it collects and implement a comprehensive data privacy program. The company is required to establish both in-house and third-party assessment programs for data protection. Dealerships must also implement oversight and training requirements to prevent unauthorized enrollment.