GM will pay $220 million to settle claims it sold drivers' data to insurers

General Motors will pay $220 million to settle claims by 36 US attorneys general that it sold drivers' driving and location data without their knowledge. The states say the data went through data brokers to insurance companies, which used it in part to set premiums. Washington and Oregon led the bipartisan coalition, which includes the District of Columbia, and the settlement was announced on 29 October. The press releases do not say GM admitted wrongdoing.

What the states say GM did

From 2016 to 2024, GM enrolled drivers in Smart Driver, a feature tied to its OnStar connected services. According to the Connecticut attorney general's office, more than 10,283,000 Americans were signed up. The program recorded the number of trips, the start and end time of each trip, hard braking, rapid acceleration and whether the driver went over the speed limit.

GM had told drivers it would not share their data with insurers without express consent. The New York attorney general's investigation found that GM instead sold the data to brokers under contracts that named insurance as the purpose. Brokers bought reports on every trip and resold them to insurers, which could then raise premiums, including for drivers who had never made a claim. Drivers were not told.

Most people were enrolled at the dealership when they bought the car. In many cases, according to the states, dealership staff accepted the terms for customers without asking them. From 2020 to 2024 GM paid sales staff bonuses based partly on enrollment numbers and ranked dealerships by how many drivers they signed up. The OnStar app also told more than 370,000 drivers they were not enrolled when they were. GM later quietly unenrolled them, but their data stayed with brokers and insurers.

What changes under the settlement

• Consent first: GM must get drivers' affirmative, express consent before collecting or sharing driving and location data.
• Less data: GM must limit the driving data it collects as part of a company-wide privacy program.
• Audits: the program will be checked by internal and third-party assessments.
• Dealers: GM must train and oversee dealerships so customers are not signed up without consent.

The money goes to the states rather than straight to drivers. New York, for example, gets $12,054,341 and Connecticut more than $6 million. Individual drivers can look to several consumer class actions against GM, which are still pending.

A GM spokesperson said the settlement builds on privacy steps the company has already taken. GM shut down Smart Driver in 2024. In January 2025 it agreed with the Federal Trade Commission not to disclose geolocation and driver behavior data to consumer reporting agencies for five years, an order Connecticut says carried no fine. In May, GM agreed to pay $12.75 million to settle a California investigation into sales of driver data to two brokers.

"GM turned private vehicles into mobile insurance surveillance machines without consumer consent or awareness," Connecticut Attorney General William Tong said. Oregon Attorney General Dan Rayfield put it shorter: "People bought a car, not a tracking device."

Owners of any connected car can check what they agreed to in the manufacturer's app and at the dealer, and switch off driving-behavior features they did not ask for.