GM to pay $220 million over selling driver location data to data brokers

GM settles with 36 states for $220 million

General Motors has agreed to pay $220 million to resolve allegations that it illegally sold driver and location information to data brokers. According to The Verge, which cites an earlier Reuters report, the deal ends a complaint brought by a coalition of 36 US attorneys general and requires GM to limit the driving data it collects and to obtain "express consent" from drivers before collecting their information.

Oregon Attorney General Dan Rayfield and Washington Attorney General Nick Brown co-led the multistate case. The group also included New York, Florida, Michigan, Nevada, Pennsylvania and many other states, according to The Verge.

How the Smart Driver program worked

The dispute centers on GM's Smart Driver program, which has since been discontinued. The service collected information about driving habits, including how drivers accelerated, how they braked, and how long their trips lasted. Prosecutors alleged that GM passed this information to data brokers, enabling insurance companies to purchase it — and in some cases to use it to raise premiums.

The states further accused GM of failing to notify drivers that they had been enrolled in Smart Driver at all, or that the automaker was collecting their data in the first place.

In a press release quoted by The Verge, Rayfield said that people "bought a car, not a tracking device." He said GM had pitched the program as a way to help people drive more safely and had promised not to share the data with insurers without permission, but that the investigation found GM sold it anyway — and that some drivers ultimately paid for it through higher insurance costs.

Settlement terms and an earlier California payout

Beyond the financial penalty, the agreement imposes ongoing conduct requirements: GM must restrict what driving data it gathers and secure drivers' express consent before collecting it, according to The Verge. The report does not specify how the $220 million will be distributed among the states or consumers.

The multistate settlement is GM's second significant payout over the practice. Just months earlier, the automaker agreed to pay $12.75 million to settle similar claims brought by California.

Why it matters

This is one of the most consequential privacy enforcement actions involving connected vehicles to date, and it carries several practical implications.

First, it establishes in legal terms what many drivers may not have realized: a modern connected car is also a data-collection platform. Programs like Smart Driver can capture granular detail about where and how someone drives, and the states' allegations show how that data can flow from an automaker to brokers to insurers without the driver's knowledge.

Second, the alleged harm is concrete rather than abstract. This is not a theoretical exposure of records — prosecutors say real drivers faced higher insurance premiums as a result of data they did not know was being collected and sold.

Third, the settlement raises the compliance bar for the industry. GM is now legally bound to limit collection and obtain express consent, a standard other automakers with similar telematics programs will likely be watching closely, and one that state attorneys general have shown they are willing to enforce collectively.

For connected-car owners, the practical takeaway is straightforward: check whether any driving-behavior or connected-services programs are active on your vehicle, review the data-sharing settings in your manufacturer's app, and opt out of anything you did not knowingly agree to. As this case shows, the data generated by your daily commute can have a price attached — just not one you were meant to see.