GM Reaches $220 Million Privacy Deal Over Driver Data Sharing

Your vehicle may be revealing more than where you go and how you drive — and that information can also influence insurance costs.

General Motors has agreed to pay $220 million to resolve claims filed by 36 U.S. states that it collected and shared drivers’ personal data without proper consent. At the center of the case is Smart Driver, a feature that tracked driving behavior and allegedly enabled sensitive information to be passed to third-party data brokers.

The deal has renewed concerns about how automakers manage customer information and whether drivers fully understand where their data ends up after turning on connected-car features.

How GM’s driving data allegedly reached insurers

The dispute traces back to a New York Times investigation that found General Motors had shared customers’ driving data with third-party brokers, including LexisNexis Risk Solutions and Verisk.

That information came from Smart Driver, a connected-car tool intended to help owners monitor their driving habits. The system collected details such as speeding, hard braking, and rapid acceleration.

According to the allegations, GM sold the information to data brokers under agreements saying it would be used for insurance-related products. Those brokers then passed the data on to insurance companies, which used it to evaluate risk and, in some cases, raise premiums.

The key issue was consent. Attorneys general said GM told customers their driving data would not be shared with insurers without explicit permission. Investigators, however, concluded that the company sold the information to brokers without making clear that it would ultimately be used for insurance purposes.

Investigators also found problems with enrollment. The Washington attorney general’s office said dealership employees allegedly accepted Smart Driver terms on customers’ behalf without authorization.

GM’s OnStar app also incorrectly told more than 370,000 drivers that they were not enrolled in Smart Driver, even though the company was collecting and selling their information. GM later removed those drivers from the program without notifying them about the mistake, but data already collected remained with brokers and insurers.

Although GM ended Smart Driver, legal scrutiny continued. Under the settlement, the automaker must pay $220 million and obtain customers’ affirmative, express consent before collecting or sharing driving and location data. The agreement also requires GM to reduce data collection, undergo privacy reviews, and strengthen oversight of dealerships to prevent unauthorized enrollment.

GM did not admit wrongdoing as part of the deal.

Why the case matters for businesses

The issue extends beyond the auto industry. Many companies gather customer data for one purpose but later face pressure to use it in other ways, making GM’s case relevant across sectors.

Businesses need to make sure data is not repurposed beyond what customers reasonably understood when they agreed to share it. A feature meant to improve the user experience should not quietly become a tool for collecting and monetizing personal information for unrelated uses.

Responsibility for protecting customer data also reaches third-party vendors.

Because many organizations rely heavily on outside partners, those vendors may gain access to customer information. Companies must ensure any vendor uses that data only for the intended purpose and does not pass it along to unauthorized parties.

Must-read security coverage

What GM owners and other drivers should do next

The settlement is a reminder that connected vehicles can gather more personal information than many drivers realize, including where they travel and how they drive.

Drivers should review the privacy settings in their automaker’s mobile app or connected-vehicle account. Look for features that track driving behavior, location, or data sharing with third parties, and turn off any optional collection you do not need or do not want.

It is also worth checking whether your automaker allows you to request a copy of your personal information or have it deleted. Even so, disabling a feature may not erase data that has already been shared with brokers or insurers.

If you are worried about how your driving history may affect insurance prices, ask your insurer what information it uses when setting premiums and whether third-party driving data is part of the process.

In the end, drivers should know what their vehicles collect, who can access that information, and how it may be used before agreeing to connected-car services.