GM Fined $220 Million for Selling Driver Data Without Consent

General Motors has reached a $220 million settlement with 35 states and the District of Columbia to resolve allegations that it collected and sold sensitive driver data without obtaining proper consent. The settlement, announced by the Washington state Attorney General's office, addresses claims that GM shared detailed driving metrics, including precise location and speed, with data brokers who then supplied this information to insurance companies.

Investigators found that GM's Smart Driver program, a feature of its OnStar subsidiary, collected data from vehicle owners. While presented to drivers as a tool for improving driving habits, the program also covertly shared this data with brokers. This occurred despite GM's assurances to customers that their information would not be shared with insurers without explicit consent. The insurers ultimately acquired the data by purchasing it from these third-party brokers.

The settlement also highlights concerning practices related to dealership enrollment. The Washington AG's office stated that GM incentivized dealerships to enroll customers into the Smart Driver program, with dealership employees sometimes accepting terms and conditions on behalf of customers without their knowledge or consent. Furthermore, GM reportedly failed to adequately notify many drivers about the extent of data collection and sharing.

Adding to the concerns, GM's OnStar app incorrectly informed over 370,000 drivers that they were not enrolled in the Smart Driver program, even as their data continued to be collected and sold. The AG's office emphasized the personal and identifiable nature of the data GM was trading.

GM discontinued the Smart Driver program in April 2024, shortly after a New York Times investigation brought these data-sharing practices to light, citing customer feedback as the reason for its closure. Beyond the financial penalty, GM has agreed to implement stricter data collection limits, enhance the protection of personally identifiable information (PII), and establish a comprehensive data privacy program.

This multi-state settlement is described by the Washington AG's office as more stringent than previous resolutions. Notably, GM had already settled similar allegations with the Federal Trade Commission (FTC) in January 2026. The FTC order mandated express consent for data collection, use, and sharing, along with requirements for data access and deletion requests, and disabling precise geolocation data collection where feasible.

Separately, California reached a $12.75 million settlement with GM on the same matter in May, and a case in Texas remains ongoing. A GM spokesperson commented that the agreement reinforces the company's efforts to strengthen privacy practices, while also asserting that connected vehicle data is crucial for providing "safer, more helpful and personalized experiences."

The automaker maintains its commitment to transparency regarding data usage, protection, and customer choices about sharing information, positioning data collection as a beneficial practice for enhancing vehicle services.