General Motors agrees to pay $220 million to settle multi-state data privacy lawsuit

General Motors agreed to pay $220 million to settle a lawsuit brought by attorneys general from 35 states and the District of Columbia. The case challenged GM’s OnStar Smart Driver practices. The program collected driving information and shared it with data brokers connected to insurance without clearly informing customers.

The settlement also changes how GM handles customer information. The company must limit the driving data it collects and protect customers’ personal information. It must also undergo internal and external assessments of its data protection and privacy programs.

GM will face additional oversight and training at its dealerships. These measures are meant to prevent customers from being enrolled without clear permission or kept unaware of data sharing. The settlement follows a separate Federal Trade Commission action that bars GM from sharing specific consumer data with third parties for five years.

OnStar Smart Driver was a GM program that logged customers’ driving behavior. The company enrolled millions of customers between 2016 and 2024, according to the reported allegations. The data was not simply kept for drivers to review; GM sold it to data brokers for insurance-related use.

The program recorded behaviors such as hard braking, driving late at night, and speeding. These details created a specific picture of how individual people drove. The attorneys general described the information as personal, identifiable, and specific.

The central problem was disclosure and consent. GM did not tell customers that their information would be sold for that purpose, and many drivers apparently did not know they were enrolled. Dealerships received bonuses for signing up customers, and employees allegedly sometimes accepted program terms for customers without express permission.

GM’s Smart Driver program operated from 2016 through 2024. During that period, the automaker enrolled millions of customers and tracked their driving habits. The reported data included hard braking, late-night driving, and speeding, making the program a large and long-running collection effort.

The legal action covered 35 U.S. states and the District of Columbia. Their attorneys general sued GM over the broader OnStar Smart Driver controversy. The case focused on enrollment, notice, consent, and the sale of driving information for insurance purposes.

GM agreed to pay $220 million to resolve the lawsuit. The article also reports that more than 370,000 drivers were incorrectly told they were not enrolled. Separately, GM reached a $12.75 million settlement with California, while the Federal Trade Commission imposed a five-year restriction on sharing specific consumer data.

GM sold driving records to data brokers for insurance use. Insurance companies then used information from the program in ways that led to higher premiums for some drivers. The article links those increases to recorded behaviors, including hard braking, speeding, and late-night driving.

The key mechanism was indirect sharing. GM collected personal, identifiable, and specific driving data, then passed it to data brokers connected with insurers. Those companies could use the records to judge a driver’s behavior. Customers were not clearly told that their information would be sold for this purpose.

The impact was especially troubling for drivers who did not know they were enrolled. More than 370,000 people were told they were not enrolled even though they were. GM eventually unenrolled them, but the attorneys general said it did not notify them about the mistake and still sold their data.

State attorneys general acted together as the government plaintiffs in the multi-state lawsuit. They challenged GM’s handling of OnStar Smart Driver data and negotiated the $220 million settlement. Their action represented drivers across 35 states and the District of Columbia.

The attorneys general alleged that GM failed to explain that customer data would be sold for insurance purposes. They also said many customers were not told they were enrolled. Dealership incentives and alleged acceptance of terms without customers’ express permission were part of the allegations.

They further raised the case of more than 370,000 drivers who were incorrectly told they were not enrolled. The attorneys general said GM later unenrolled those people but did not tell them about the error and still sold their information. Their settlement requires changes to GM’s data practices and privacy oversight.

The settlement requires GM to change how it collects and protects driving information. It must limit the driving data gathered from customers and safeguard their personal information. These requirements address the concern that identifiable driving records were collected and sold without clear customer understanding.

GM must also undergo internal and external assessments of its data protection and privacy programs. The company will face oversight and additional training at dealerships. Those dealership measures matter because the attorneys general said employees were sometimes incentivized to enroll customers and allegedly accepted terms without express permission.

The Federal Trade Commission added a separate restriction earlier this year. It banned GM from sharing specific consumer data with third parties for five years because of the issue. California also reached its own settlement with GM for $12.75 million in May. Together, these actions increase limits and scrutiny around GM’s data practices.

Telematics data is information collected from a vehicle or connected service about driving behavior. Insurers generally use it to estimate risk by examining patterns such as speeding, hard braking, mileage, time of driving, and sudden maneuvers. Safer-looking patterns may support lower prices, while riskier patterns may contribute to higher premiums, depending on the insurer and policy.

The article gives a concrete example through GM’s Smart Driver program. GM logged hard braking, late-night driving, and speeding, then sold the information to data brokers for insurance. The article says insurance companies raised premiums for people based on information from the program.

The article does not specify insurers’ exact formulas or how much each behavior changed a premium. It does show why consent matters: customers’ personal, identifiable driving data influenced insurance outcomes, even though many were not told they were enrolled or that their data would be sold.