General Motors will pay $220 million to resolve claims by a coalition of 36 attorneys general that it sold drivers' location and driving-behavior data to data brokers, who passed it to auto insurers, the Washington attorney general's office announced Thursday. The settlement requires the automaker to get drivers' explicit opt-in consent before collecting or sharing that data, a model for any company that earns money from information its connected products gather.
What Happened
Washington and Oregon led the coalition of 36 attorneys general, which includes the District of Columbia. According to the release, GM enrolled millions of drivers from 2016 to 2024 in Smart Driver, a feature promoted as a safety tool. The states allege GM sold the data, including hard braking, rapid acceleration and speeding, to brokers under contracts that specified insurance uses. Insurers used it in part to set rates, and drivers were not told, the states say.
Most sign-ups happened at dealerships, through an enrollment shared with GM's OnStar connected-services system. The states allege some dealership employees accepted terms for customers without their consent, while employees earned bonuses tied to enrollment numbers. The OnStar app also wrongly told more than 370,000 enrolled drivers that they were not enrolled; GM later unenrolled them without telling them and left their data with brokers and insurers, the release says.
Under the consent decree filed in King County Superior Court, GM agreed to the terms without admitting any facts or liability. It must limit the driving data it collects, keep a privacy program subject to internal and outside assessments, and train and oversee dealers. It must also delete driving data retained before Jan. 16, 2025, within 180 days of the decree taking effect, with exceptions such as litigation holds and safety investigations, unless drivers agree to its retention.
"Washingtonians' data is personal and valuable, which is why they should always have control over how it's used," Attorney General Nick Brown said in the release. A GM spokesperson told The Record, which reported the settlement Thursday, that the agreement addresses a product GM ended in 2024.
Why It Matters
Without a federal privacy law, state attorneys general acting together are writing the rules for telematics, the data vehicles send back about how and where they are driven. The terms reach GM's dealers too, a reminder that companies answer for how partners obtain consent when incentives reward enrollment. Boards of companies that sell device or vehicle data should check what their contracts let buyers do with it.
Context
GM ended Smart Driver after The New York Times reported on the practice in 2024. The Primary Wire reported in September, citing TechCrunch, that a study of 21 vehicles found most sent data to outside companies, and that carmakers' companion apps added to the exposure.
What to Watch
Washington's decree takes effect Nov. 30, and GM must make the $220 million payment within 30 days after that. Texas Attorney General Ken Paxton's separate 2024 lawsuit over similar conduct is ongoing, The Record reported; Texas seeks civil penalties of up to $10,000 per offense and a court order requiring GM to delete the collected data.
