General Motors Agrees to $220 Million Settlement Over Driver Data Collection

General Motors has agreed to pay $220 million to 35 states and the District of Columbia as part of a major privacy lawsuit settlement.

The lawsuit centers on the company's Smart Driver program, which was offered to drivers from 2016 to 2024 through dealerships. The program collected data on drivers' habits, which in some cases was sold to insurance companies. This practice raised concerns about driver privacy and led to significant premium increases for some drivers.

A 2024 investigation by a major news organization revealed that GM's sales of driving history could be used by insurance companies to set rates. In one instance, a driver saw their premiums increase by 22% after GM sold their driving information to an insurance company through a data broker.

The data collection was widely criticized as "spying, and GM quickly ended the Smart Driver program in response to the backlash. The company also faced scrutiny from regulators over its handling of driver data.

In 2025, GM settled with the Federal Trade Commission over its sale of driver data, agreeing to a five-year ban on selling such information.

The settlement reached by General Motors requires explicit consent from consumers before collecting or disclosing their driving and location data. This means that GM must now obtain clear permission from customers before gathering and sharing such information. The move is a significant step towards greater transparency in the way connected vehicle data is handled.

GM has also taken steps to strengthen its privacy practices, including ending its Smart Driver product in 2024. In an effort to reassure customers, the company has emphasized its commitment to being clear about what information is used and how it's protected. This includes giving consumers choices about what they share with the company.

As part of its efforts to enhance consumer trust, GM has created a Privacy Center for customers and simplified and updated its US privacy statement. The company claims that these measures demonstrate its dedication to transparency and customer consent. However, some experts are skeptical about the effectiveness of these changes.

The issue of connected vehicle data collection is not unique to GM, but rather a widespread practice in the auto industry. According to Peter Cassat, technology partner at CM Law, collecting and selling driving data is an industry norm." He notes that GM's case may be particularly egregious, but it represents a broader problem that needs to be addressed.

The settlement and subsequent changes made by GM have sparked concerns about the potential for further action against companies engaging in similar practices. As regulators continue to scrutinize the auto industry, it remains to be seen whether other companies will face similar consequences for collecting and selling driving data without consent.

Regulators have gained valuable insight into how to approach enforcement actions against companies that collect and sell driving data without consent.

A key takeaway from General Motors' $220 million settlement is that it has provided a template for regulators to follow in future cases. This precedent is likely to lead to more settlements and enforcement actions, as state attorneys general are now aware of the potential consequences.

To promote best practices in the auto industry, vehicle manufacturers should obtain explicit consent from drivers before collecting their data. This involves asking for permission feature by feature, in clear and simple language, rather than relying on a blanket checkbox or fine print.

The issue of data hygiene is particularly relevant when it comes to modern vehicles, which often transmit data to manufacturers through background systems without the driver's knowledge or control. This can lead to significant privacy concerns, especially if drivers have granted their smartphones access to sensitive information while driving.

Modern cars are becoming increasingly vulnerable to privacy risks, posing a threat similar to those associated with smartphones.

This is largely due to the fact that many drivers are unaware of the potential for their driving data to be shared without their consent. Meanwhile, automotive manufacturers have not been subjecting themselves to the same level of scrutiny as other smart device makers when it comes to security and privacy concerns.

Car owners can take some precautions to protect their data, including opting out of unnecessary data sharing agreements and reviewing their Customer Disclosure Report to see if driving information is being collected.