US automotive major General Motors (GM) has agreed to pay $220m to resolve allegations brought by attorneys general from 35 US states and the District of Columbia over driver data collection and sales.
Washington and Oregon co-led the settlement, under which Washington will receive $12.3m.
Go deeper with GlobalData
Discover B2B Marketing That Performs
Combine business intelligence and editorial excellence to reach engaged professionals across 36 leading media platforms.
The agreement requires GM to secure affirmative express consent before gathering or sharing records relating to vehicle use and location.
GM must also limit future data collection through a comprehensive privacy programme.
It is required to conduct internal and external privacy reviews, establish compliance oversight, and provide training to staff across its franchised dealership network.
The state investigation found that GM enrolled millions of drivers in its Smart Driver programme between 2016 and 2024.
The programme was presented as a way for consumers to track and improve driving safety.
GM told participants their information would not be provided to insurers without explicit consent.
Investigators, however, found that the company entered into contracts with data brokers that identified the information for insurance-product use.
Those brokers then sold the data to insurance underwriters, which used it in setting policy premiums.
The information transferred included identifiable, trip-level details such as the number of journeys, journey start and end times, hard-braking events, rapid acceleration, and driving above posted speed limits.
Most enrolments occurred at franchised dealerships during vehicle purchases, when Smart Driver was included in the registration process for GM’s OnStar connectivity suite.
Dealership sales staff allegedly agreed to terms and conditions on behalf of customers without their consent.
GM also operated performance schemes that paid bonuses to sales staff and ranked dealerships according to connected-vehicle enrolment volumes.
The investigation further found that GM’s systems did not correctly display enrolment status.
The OnStar mobile app “mistakenly” told more than 370,000 drivers that they were not enrolled in Smart Driver while their driving information continued to be collected and commercialised.
GM later removed those individuals from the programme without formally informing them.
Their earlier records remained with data brokers and insurers.
Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont formed the executive committee supporting Washington and Oregon.
Attorneys general from additional states also joined the coalition.
Washington Attorney General Nick Brown said: “Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used. We are proud to lead this bipartisan agreement holding GM accountable for misusing drivers’ data.”
