Overview
General Motors has agreed to pay $220 million to settle a lawsuit brought by a coalition of 36 state attorneys general. The states alleged GM unlawfully sold information about driver behavior and location to outside parties. Washington Attorney General Nick Brown co-led the effort.
What the States Alleged
According to the allegations, GM sold location and driving behavior data to data brokers, who in turn sold it to insurers, affecting drivers' premiums.
The Smart Driver Program
- The practice allegedly ran from 2016 through 2024, enrolling millions of people.
- The New York Times exposed it in April 2024, and GM ended the program that year.
- GM marketed Smart Driver as a way to improve driving safety and promised not to give insurers data without consent.
- Dealership employees allegedly received bonuses for enrollments, and dealerships were ranked against each other.
- Data collected included trip counts, start and end times, hard braking and acceleration, and speeding.
- A one-time Smart Driver sign-up allegedly also enrolled customers in OnStar services.
- GM allegedly told more than 370,000 customers their data was not being monitored when it was not enrolled, then quietly unenrolled them. Data already collected was not retrieved from brokers or insurers.
Settlement Terms
| Requirement | Detail |
|---|---|
| Payment | $220 million |
| Consent | Affirmative express consent before collecting or sharing driving behavior and location data |
| Data minimization | Reduce the driving data collected |
| Privacy program | Comprehensive program with internal and external assessments |
| Dealership oversight | Better oversight and training so staff cannot enroll customers in data programs without approval |
A separate suit filed by Texas Attorney General Ken Paxton in 2024 is still ongoing. Texas seeks a jury trial, civil penalties of up to $10,000 per offense, and an order to delete the collected data.
Takeaways
- Connected-vehicle telemetry is treated as sensitive personal data by regulators, and consent obtained through bundled sign-ups is unlikely to hold up.
- Incentives for frontline staff to enroll customers create their own compliance risk.
- Organizations sharing data with brokers should confirm the downstream use of that data, since the harm here came from insurer pricing.