General Motors agreed to pay $220 million to resolve allegations that it unlawfully sold or shared private driving and location data from millions of customers, in a pattern reminiscent of apps secretly tracking users without clear disclosure. The coalition behind the settlement spans 35 states plus the District of Columbia, representing 36 attorneys general in total.
The data in question came from Smart Driver, a GM program that regulators say was marketed as a tool to help drivers improve their safety habits. Attorneys general allege GM sold that data under contracts specifying it would be used for insurance products.
Data brokers received the information and supplied it to insurers, who allegedly used it to set or adjust customer premiums , a model that echoes how a surveillance app can quietly funnel personal data to third parties. Many drivers enrolled in Smart Driver were also users of OnStar, GM’s connected-vehicle safety, navigation, and diagnostic service, which expanded the number of people potentially affected.
Required Changes Under the Settlement Terms
The agreement forces GM to overhaul how it collects and discloses connected-vehicle data, starting with a stricter consent standard.
The settlement requires GM to obtain affirmative, express consent before collecting or disclosing covered driving and location data. Passive enrollment or disclosures buried in fine print no longer satisfies that standard under the agreement’s terms.
GM must also limit how much driving data it collects and build a comprehensive privacy program subject to both internal and external assessments. Dealership training is required to prevent customers from being enrolled in data-collection programs without their knowledge.
A GM spokesperson said connected-vehicle data enables safer and more personalized services. The spokesperson added that GM is committed to being clear about what information is used, how it is protected, and the choices customers have about what they share. Because no canonical source was available for those statements, they are attributed to the company’s response to the settlement.
Drivers Get No Direct Payout
The entire $220 million goes to the states, leaving individual drivers without compensation from this agreement.
The settlement includes no consumer restitution. The $220 million is paid to the participating states, not to drivers whose insurance rates may have been affected by the data-sharing.
A separate private class-action lawsuit seeking monetary relief for affected drivers remains pending. Drivers hoping to recover money would need to follow developments in that litigation rather than this multistate settlement.
Regulators Have Been Moving on This for Months
The multistate agreement is one of several regulatory actions closing in on GM’s connected-vehicle data practices.
In January 2025, the Federal Trade Commission announced a proposed order that would bar GM and OnStar for five years from sharing drivers’ geolocation and behavior data with consumer reporting agencies. That data is collected through a vehicle’s embedded systems, a practice known as telematics. The proposed order also requires affirmative consent before collecting such data, with narrow exceptions including providing location information to emergency responders.
GM separately agreed in May to pay $12.75 million, subject to court approval, to resolve a California investigation into alleged data sales to two brokers.
The Larger Industry Tension
The GM case forces a broader question about whether safety-program data was repurposed for insurance decisions without drivers’ knowledge.
Insurers including Allstate, Progressive, and Geico use telematics programs, generally describing them as a way to reward safer drivers with lower premiums. The dispute over GM’s practices sharpens a question that regulators say the industry has not answered clearly. Did drivers knowingly consent to having data collected for safety purposes later used in underwriting decisions? Concerns about vehicle location tracking by third parties make that question especially pressing.
If you drive a GM vehicle and used OnStar or enrolled in Smart Driver, consider reviewing the following:
- Your connected-service enrollment status in the GM or OnStar app
- Privacy settings and any active data-sharing consents
- Any telematics consent you may have accepted at a dealership
- Opt-out options available through GM’s privacy portal
The settlement sets a clearer consent standard for GM’s data practices going forward. Whether it produces any consequence for drivers already affected will depend on the outcome of the pending class action.
