GM Data Practices: $220 Million Settlement Announced

General Motors will pay $220 million to settle claims that it improperly shared private driving data with third parties, according to Attorney General Charity Clark and a coalition of 35 other state attorneys general. The settlement resolves allegations that GM sold consumer location and behavior data to data brokers who then passed the information to insurance companies. Vermont, which helped lead the multi-state investigation, is set to receive $4.54 million of the total funds.

The dispute centers on GM's Smart Driver program, active from 2016 to 2024. The program tracked millions of drivers, including tens of thousands in Vermont, to monitor habits such as braking, acceleration, and speed. GM marketed the tool as a safety feature and told drivers their data would not be shared with insurers without express consent. The coalition found that GM instead sold the data under contracts specifically intended for insurance products.

Enrollment often occurred at car dealerships, where sales staff were incentivized by bonuses to sign customers up for GM's OnStar services. In many instances, dealership employees accepted terms and conditions on behalf of customers without explicit approval. GM's own systems also contained errors. The OnStar app incorrectly stated that more than 370,000 drivers were not enrolled in Smart Driver when their data was actually being collected and sold.

After the New York Times reported that insurers used the data to adjust premiums, GM discontinued the Smart Driver program. The company quietly unenrolled the 370,000 affected drivers but left their existing data with brokers and insurers. The information sold was specific and personal, including trip start and end times, frequency of driving, and instances of hard braking or speeding.

Under the settlement terms, GM must obtain affirmative express consent from consumers before collecting or disclosing driving and location data. The company must also limit the amount of data it collects and implement a comprehensive data privacy program. The agreement requires internal and external assessments of data protection and mandates training for dealership staff to prevent unauthorized enrollment.

Attorney General Clark stated that the settlement puts corporations on notice that consumer data belongs to the individual and not the company. "Every Vermonter deserves to have a choice over whether or not they share their personal data with a company," Clark said. "Today's settlement puts corporations on notice that your data is yours and not a resource to be bought and sold without your consent."

The 36-state coalition includes the attorneys general of Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Hawai'i, Idaho, Illinois, Kansas, Kentucky, Maine, Massachusetts, Maryland, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Virginia, Washington, and Wisconsin.