GM to pay $220 million in multistate settlement over driver data privacy

Ohio will receive roughly $8 million under a sweeping $220 million multistate settlement with General Motors, resolving allegations that the automaker illegally sold consumers’ driving behavior and location data to third parties.

How the OnStar Smart Driver Program Tracked Motorists

The legal action centers on the automaker’s Smart Driver program, which tracked driving habits from 2016 to 2024. General Motors originally marketed the feature as a tool for vehicle owners to monitor their own driving habits via a smartphone application. Behind the scenes, however, driver metrics flowed to LexisNexis. Insurance brokers then accessed those reports to supply insurance companies, which subsequently adjusted premium costs or denied coverage based on individual driving habits.

GM Agrees to $220 Million Settlement for Selling Driver Data

Most participants enrolled while purchasing their vehicles at local dealerships. Dealership staff received financial incentives and performance rankings tied directly to connected vehicle service sign-ups, often bundling the program into the standard OnStar registration process. According to a statement from Ohio Attorney General Andy Wilson, the OnStar application incorrectly told 380,000 drivers they were not enrolled in the data collection program when, in reality, the company was collecting and selling their data.

GM later unenrolled those motorists without notifying them about the error, leaving their information with brokers and insurance companies. GM broke consumers’ trust by selling such data without their knowledge and consent, Ohio Attorney General Andy Wilson said in a statement. Ohioans should not have to worry that the information collected by their own vehicles will be used against them. Companies must be held accountable when they put profits ahead of consumers’ privacy.

GM reaches $220 million settlement over allegations it violated drivers’ privacy

General Motors Must Obtain Express Consumer Consent for Data Collection

The nationwide coalition behind the legal challenge included 36 attorneys general. Under the terms of the agreement, General Motors must secure explicit permission from consumers prior to gathering or sharing location and driving information, restrict the volume of driving details it archives, and safeguard personal data by implementing an all-inclusive privacy initiative.

The settlement mandates internal and external assessments of GM's data protection and privacy program, alongside oversight and training requirements for dealership networks to prevent data collection without consumers' consent. Earlier this year, the Federal Trade Commission imposed a five-year ban preventing General Motors from disclosing driver location and behavior data to consumer reporting agencies. Additionally, the automaker is obligated to secure explicit consumer permission prior to harvesting or utilizing information, while also simplifying the process for users to opt out of tracking and erase previously gathered records.

GM to pay $220 million in multistate settlement over driver data privacy — Photo: finance.yahoo.com

When reached for comment, a GM spokesperson defended the company’s trajectory and emphasized that the contested feature has already been dismantled. This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices, the representative noted. The manufacturer asserts that modern connected vehicle information supports safer, more tailored, and beneficial experiences, maintaining firmly that it refrains from commercializing personal vehicle details connected to specific individuals, their driving patterns, or their physical coordinates.

Ohio’s specific share of the settlement totals $8,076,105.