Your car knows a lot about you. How fast you drive, where you go, and even how hard you brake. But what happens when that information is sold to insurance companies, despite promises that it won’t be shared without your consent? For General Motors, the answer is a $220 million privacy settlement.
On October 29, a coalition of 36 attorneys general announced the settlement over allegations that GM sold consumers’ driving behavior and location data without their knowledge or consent. Data brokers then supplied the information to insurers, which allegedly used it to help set rates, sometimes increasing drivers’ premiums.
The allegations centered on GM’s Smart Driver program. From 2016 to 2024, GM promoted the program as a way to improve driving safety and told consumers their information would not be shared with insurers without express consent. According to the attorneys general, GM instead sold the information under contracts specifying insurance use. The data included trip times, speeding, hard braking, and rapid acceleration.
Smart Driver’s enrollment process raised separate concerns. Dealership employees allegedly accepted terms on customers’ behalf without permission, while bonuses and dealership rankings encouraged enrollment. The OnStar app also incorrectly told more than 370,000 drivers they were not enrolled even though GM was collecting and selling their data.
Connecticut began investigating GM and issued an initial notice of violation in 2024, among its first enforcement actions under the Connecticut Data Privacy Act. Connecticut later helped lead the multistate investigation, while Oregon pursued GM under its longstanding Unlawful Trade Practices Act. Together, the states’ actions illustrate how both newer privacy statutes and traditional consumer protection laws can be used to challenge data practices.
The settlement requires more than payment. GM must obtain affirmative express consent before collecting or disclosing driving and location data, limit its collection, maintain a comprehensive privacy program, undergo internal and external assessments, and implement dealership oversight and training.
The GM settlement is a reminder that privacy compliance doesn't end with a well-written policy or a checked consent box. The allegations illustrate how problems can arise when sales incentives, enrollment practices, and technology don't align with consumer promises. If a company's employees, apps, and data partners aren't following the same rules, even carefully drafted disclosures may offer little protection.