General Motors has agreed to pay $220 million to 35 states and the District of Columbia to settle a privacy lawsuit concerning the sale of driver data collected through its Smart Driver program. Dealerships offered the program to customers between 2016 and 2024.
The agreement follows a 2024 investigation by The New York Times, which reported that information about drivers’ habits could, in some cases, be used by insurance companies when setting premiums. The New York attorney general’s office said one driver was told that data supplied by a broker had contributed to a 22% premium increase.
GM ended the Smart Driver program in 2024. In 2025, the company also reached a settlement with the Federal Trade Commission involving Smart Driver and OnStar location data, accepting a five-year ban on selling driver data.
Under the new multistate settlement, GM must receive affirmative, express consent before collecting or disclosing consumers’ driving and location information. Maryland Attorney General Anthony G. Brown said the company had sold customer data without asking permission and that the agreement would prevent it from putting profit ahead of residents’ privacy.
A GM spokesperson said the company had strengthened its privacy practices since ending Smart Driver. The automaker said it had simplified and updated its US privacy statement, launched a consumer Privacy Center and enhanced internal controls for connected-vehicle data. GM also said connected data can support safer, more useful and personalized experiences, while pledging to clarify how information is used and protected.
The case has also raised broader concerns about automotive data practices. Modern vehicles can collect information such as location data, diagnostic details, contacts and music lists, while background systems may transmit information to manufacturers. Drivers may have limited control over what is collected or who can purchase it.
Peter Cassat, a technology partner at CM Law and former general counsel for Cox Automotive and New Country Motor Group, said the collection and sale of driving data was common across the industry rather than unique to GM. He said the settlement could provide a model for additional enforcement actions by state attorneys general and recommended that vehicle providers request consent for individual features in clear language.
Clyde Williamson, a senior security architect at Protegrity, compared connected vehicles’ privacy risks with those of smartphones. He said consumers should opt out where possible, avoid unnecessary data sharing, review their Customer Disclosure Report for driving information and consider disabling a vehicle modem if that option is available.
Sources: CNET.