GM Pays $220 Million for Unauthorized Sale of Driving Data

A coalition of 36 state attorneys general announced a $220 million settlement with General Motors (GM) on Thursday, Oct. 29, for selling drivers' personal driving and location data to data brokers, who then resold the information to insurance companies. The case is emblematic of how the connectivity of modern vehicles has created a new frontier of consumer surveillance that regulators and state lawmakers are only beginning to challenge.

The dispute centers on GM's Smart Driver program, a free feature within the OnStar app that monitored and recorded driving habits — including hard braking, rapid acceleration, late-night trips, and seatbelt use — while promising to help drivers improve their safety behind the wheel. What it did not disclose, however, was that the data was sold to brokers such as LexisNexis and Verisk, which compiled detailed profiles on each driver and sold those profiles to insurance companies that then adjusted premiums based on driving patterns.

According to the attorneys general of New York and Washington, who led the investigation, more than 700,000 New York drivers alone were enrolled in the program. Nationwide, the number reached into the millions. One particularly troubling finding was that the OnStar app erroneously informed over 370,000 drivers that they were not enrolled in Smart Driver, when in fact GM was collecting and selling their data the entire time. The company later quietly disenrolled these users without notifying them and left their data in the hands of brokers and insurers.

The scope of the data sold was personal, identifiable, and specific. Insurers could see how many times a person drove their vehicle, the start and end times of each trip, how many times they braked or accelerated hard, and whether they exceeded the speed limit. One vehicle owner reported by the New York attorney general had their insurance premium increased by 22 percent after a broker presented a 130-page report covering all their trips from the previous six months.

The story gained traction when The New York Times published an investigation in March 2024, conducted by reporter Kashmir Hill, revealing that GM was collecting data as frequently as every three seconds. Following the report, GM discontinued the Smart Driver program in April 2024 and cut ties with the data brokers. But the legal action continued.

In January 2025, the Federal Trade Commission (FTC) finalized a separate order banning GM and its OnStar telematics service from sharing certain types of connected vehicle data with consumer reporting agencies. The FTC order, valid for 20 years, requires GM to obtain explicit consent before collecting, using, or disclosing connected vehicle data. In May 2026, California secured an additional $12.75 million settlement.

The October 2026 national settlement is significantly more comprehensive than any previous resolution reached with GM. It requires not only affirmative express consent before collecting or sharing driving and location data, but also the implementation of a comprehensive data privacy program, internal and external assessments of the data protection program, and dealership oversight and training requirements to protect consumers against data collection schemes without consent.

Pennsylvania Attorney General Josh Shapiro emphasized that "Pennsylvanians deserve transparency and honesty about how their personal data is collected, shared, and used." Delaware Attorney General Kathy Jennings added that the case "also highlights why this year's Delaware Personal Data Privacy Act amendments are so important: they help stop businesses from selling sensitive data."

The GM case raises broader questions about privacy in connected vehicles. The automotive industry is undergoing accelerated digital transformation, with cars increasingly resembling computers on wheels equipped with advanced driver-assistance systems, over-the-air (OTA) software updates, and autonomous driving features. Every sensor, camera, and telematics module generates data constantly. The question is: who owns that data, and who can sell it?

In a statement, GM said the settlement "addresses Smart Driver, a product we ended in 2024, and reinforces steps we've taken to strengthen our privacy practices." The company highlighted that "safer, more helpful and personalized experiences are enabled by connected vehicle data" and that it is "committed to being clear about what information is used, how it's protected, and the choices customers have."

What remains to be seen is whether the $220 million settlement — the largest ever obtained in a connected vehicle data privacy case — will serve as a precedent for other manufacturers. Toyota, Ford, Honda, and other automakers are also collecting telematics data. The distinction between selling data to brokers and using it internally to improve navigation and safety services may be thin in practice. While state privacy regulations vary widely — from California's robust CCPA to jurisdictions with no specific protections — the pressure for a coherent federal framework is likely to grow. The GM settlement shows that, until then, state attorneys general are willing to step into the role of consumer privacy guardians in the connected car era.

Sources: The Verge, TechCrunch, Office of the Attorney General of New York

✓ Independent sources cross-checked and verified before publishing