GM settles for $220 million over selling driver location data to brokers

General Motors has agreed to pay $220 million to 36 US states to settle allegations that it illegally sold drivers' private location and driving-behavior information to data brokers, according to TechCrunch. The deal, announced Thursday, also requires the automaker to obtain drivers' express consent before it collects or shares driving and location data.

What the settlement requires

The agreement resolves a lawsuit brought by a coalition of attorneys general from 36 states, who alleged that GM sold driver information to brokers that then resold it to insurance providers. Its consent terms align with separate agreements GM previously reached with California and the Federal Trade Commission.

The multi-state deal adds one element those earlier agreements lacked: GM must bring in a third party to assess whether the company is complying with the privacy program it has put in place.

GM said the settlement covers Smart Driver, a product it ended in 2024, and reinforces steps it has already taken to strengthen its privacy practices. The automaker added that connected-vehicle data enables safer and more personalized experiences, and said it is committed to being clear about what information is used and what choices customers have.

How the data flowed

The case traces back to a New York Times report published more than two years ago, which showed how GM and its OnStar service collected, used and sold drivers' precise geolocation data and driving behavior to third parties, including the data brokers LexisNexis and Verisk.

That information came from Smart Driver, a free feature inside GM's connected-car apps that tracked and rated driving behavior, including seatbelt use. Brokers sold the data on to insurance companies, where it could affect customers' rates, the NYT reported at the time.

GM discontinued Smart Driver in 2024, but that did not end its legal exposure. In January, the FTC finalized an order banning GM and OnStar from sharing certain consumer data, with transparency and explicit-consent requirements that parallel the state settlement.

GM now says it no longer sells vehicle information that can be linked to an individual, their vehicle's location, or how they drive. The company may still disclose anonymized data to certain partners, and it has updated its privacy policy and built a consumer-facing Privacy Center.

More sensors, more data, more scrutiny

The settlement arrives as vehicles ship with more sensors and computing power, and as automakers bet on software-centric cars that connect to drivers' calendars, messages and email.

GM itself is adding a personal AI assistant to OnStar, its 30-year-old safety and roadside assistance service. Vehicle cameras will connect to the software to provide live views and crash and safety recordings, and drivers will be able to control functions such as climate by voice.

When it announced the assistant at its GM Forward event in October, GM emphasized privacy safeguards: customers decide what data is shared, recordings have time limits and are encrypted, and the company says neither GM nor OnStar can access Connected Camera recordings. There is a trade-off, though. GM acknowledged that customers who opt out of sharing data will likely have limited access to certain features.

Why it matters

The settlement treats connected-car telemetry the way regulators treat other sensitive personal data: as something that cannot be sold to brokers without explicit permission. With 36 states acting together, alongside parallel FTC and California agreements, GM is now bound by a consent-plus-independent-audit model on multiple fronts.

The precedent extends beyond one automaker. As the industry pushes into AI assistants, always-on cameras and deeply integrated apps, vehicles will generate far more intimate data than the telematics program at the heart of this case. The deal signals that monetizing that data through broker relationships carries a measurable legal and financial price, and that drivers who withhold consent may find reduced functionality, not just privacy, is what they get in return.