GM must get express consent before collecting driver location data under $220m deal with 36 attorneys general
General Motors will pay $220m and must obtain express consent before collecting or sharing driving and location data, after a 36-attorney-general case over Smart Driver.
General Motors will pay $220m and must obtain affirmative express consent before collecting or sharing driving and location data, under a settlement with a coalition of 36 attorneys general.
Washington and Oregon co-led the case. Washington receives $12.3m, Oregon more than $10.4m, and Delaware $4,726,779.
From 2016 to 2024, GM enrolled millions of drivers in its Smart Driver programme, which tracked their driving habits. GM told drivers it would not share their data with insurers without express consent.
The attorneys general said GM instead sold the information to data brokers under contracts that specified use in insurance products. The brokers sold it on to insurers, which could change a driver’s premium based on how they drove.
The data was identifiable. Insurers could see how many times a person drove, the start and end time of each trip, how often they braked or accelerated hard, and whether they went over the speed limit.
Most drivers were enrolled at the dealership when they bought the car, through a single sign-up that also covered GM’s OnStar connected services. Dealership employees allegedly accepted the terms and conditions on customers’ behalf without their consent.
Sales staff earned bonuses based partly on how many customers they enrolled in connected services, and dealerships were ranked on enrolment numbers.
A separate fault affected more than 370,000 drivers. The OnStar app told them they were not enrolled in Smart Driver when they were, and GM collected and sold their data. GM later unenrolled them without telling them about the mistake, and their data stayed with brokers and insurers.
Oregon Attorney General Dan Rayfield said the programme had been pitched as a safety aid. “People bought a car, not a tracking device,” said Attorney General Rayfield.
Under the settlement, GM must limit the driving data it collects and run a data privacy programme. That programme faces internal and external assessments, and Delaware said it also carries board-level oversight.
GM must also put oversight and training in place at dealerships so customers are not signed up for data collection without consent. Trade title just-auto described this as covering staff across its franchised dealership network.
GM discontinued Smart Driver in June 2024, after The New York Times reported on how insurers used the data. The consent requirement therefore governs what GM collects and shares from here on.
Oregon brought the case under its Unlawful Trade Practices Act, a long-standing consumer protection law. Much of GM’s conduct came before the Oregon Consumer Privacy Act took effect in July 2024, and Oregon said that act bans the sale of precise geolocation data by all covered entities, GM included.
Delaware’s attorney general linked the case to this year’s amendments to its own privacy law, and Kathy Jennings said they would help the state stop businesses selling sensitive data. More on motoring regulation is on the site.
“Delawareans deserve to be able to trust that companies won’t illegally share their private data,” said Attorney General Kathy Jennings.
More on Regulation
- ICCT study finds weakening EU car CO2 rules could cut up to 185,000 jobs by 2035, 6% below 2025
- DVSA tests 18 vehicles against Euro 6 and Euro 5 in 2025 emissions programme, names six with no compliance concerns
- TfL proposes fully electric requirement for newly licensed London minicabs from 3 July 2028
- SMMT says ZEV mandate needs 265,000 more BEV sales in Q4 to hit 33% as consultation closes
