General Motors has agreed to pay $220 million to settle allegations that it improperly sold drivers’ location and driving behavior data to third parties. The GM driver data settlement involves attorneys general from 36 U.S. jurisdictions, including the District of Columbia.
The agreement, announced Thursday, requires General Motors to obtain customers’ explicit consent before collecting or sharing their driving and location information. The automaker must also undergo independent assessments of its privacy practices.
The settlement resolves allegations that GM provided personal driving records to data brokers, which then sold the information to insurers. Insurers could use those records when determining customers’ premiums.
GM Driver Data Settlement Follows Smart Driver Investigation
The allegations center on GM’s Smart Driver program, which ran from 2016 until GM discontinued it in 2024. The free feature, available through GM’s connected vehicle services, monitored driving habits, including speeding, hard braking, acceleration and seat belt use.
A New York Times investigation published in March 2024 revealed how GM and OnStar shared detailed driving records with data brokers LexisNexis and Verisk. Some drivers subsequently discovered that their insurance premiums had increased.
State investigators also found problems with customer enrollment. Some dealership employees allegedly accepted data-sharing terms on buyers’ behalf without obtaining their permission.
GM discontinued Smart Driver following the reporting, but investigations continued. The company said Thursday that the settlement addresses the discontinued program and reinforces changes already made to its privacy practices.
Settlement Requires Stronger Privacy Protections
The latest agreement builds on earlier regulatory actions over GGM’shandling of connected-vehicle information. In January 2026, the Federal Trade Commission finalized an order restricting how GM and OnStar collect and share sensitive driving data.
That order prohibits certain disclosures to consumer reporting agencies for five years. It also requires greater transparency and customer consent, with limited exceptions.
The multistate settlement adds requirements for independent privacy assessments and dealership oversight. GM must also provide training intended to prevent customers from being enrolled in data collection programs without authorization.
GM says it no longer sells identifiable vehicle location or driving behavior information. The company may continue sharing anonymized information with certain partners and has updated its privacy policy and customer-facing Privacy Center.
New OnStar AI Features Raise Privacy Questions
The settlement comes as GM expands the technology available in its connected vehicles. Earlier in October, the automaker announced an AI-powered OnStar assistant that will introduce voice-controlled vehicle functions and connected-camera features.
The system will let drivers adjust climate settings, ask questions about vehicle features, and access certain camera recordings. GM says those recordings will be encrypted and subject to retention limits.
According to the company, neither GM nor OnStar can access Connected Camera recordings. Customers can also manage data-sharing permissions, though declining certain permissions could limit access to some features.
The new requirements will apply as GM continues developing software-based vehicle services that depend on information collected from drivers and their vehicles.
