General Motors Pays $220 Million in Multistate Data Settlement

General Motors has agreed to pay $220 million to resolve allegations that the automaker sold private driver data without proper consent. The settlement resolves a multistate legal action brought by a coalition of 36 attorneys general. The funds will be distributed among the participating states based on their contributions to the case.

Hawaii’s Department of Commerce and Consumer Affairs will receive $2,861,340 from the total settlement amount. The state joined the coalition to challenge General Motors' practices regarding the collection and sale of consumer information. The agreement mandates specific changes to how the company handles driver data in the future.

From 2016 to 2024, General Motors operated a program called Smart Driver. The program tracked driving habits such as speed, braking, and acceleration for millions of enrolled users. The company initially marketed the tool as a safety feature to help drivers improve their habits. It told customers that their data would not be shared with insurers without express consent.

Attorneys general found that General Motors sold this data to third-party brokers. Those brokers then sold the information to insurance companies. The contracts for the data specified its use for insurance products. Insurers used the detailed driving records to set or adjust premiums. General Motors did not inform drivers that their data would be used for this purpose.

Most consumers enrolled in Smart Driver at dealerships during the car purchase process. The company used a single sign-up form for Smart Driver and its OnStar services. Dealership employees often accepted the terms on behalf of customers without obtaining their direct consent. Sales staff received bonuses based on the number of customers enrolled in connected vehicle services. Dealerships were also ranked by these enrollment numbers.

General Motors' internal systems failed to accurately reflect enrollment status. The OnStar app incorrectly told more than 370,000 drivers that they were not enrolled in the program. In reality, the company was collecting and selling their data. General Motors later unenrolled these drivers without notifying them of the error. The company left the previously collected data with brokers and insurers.

The data sold included specific, identifiable details about individual drivers. This included the number of times a vehicle was driven, the start and end times of trips, and instances of rapid braking or acceleration. It also recorded whether drivers exceeded speed limits. The New York Times documented how insurance companies used this information to change rates, sometimes raising premiums.

Mana Moriarty, executive director of Hawaii’s Office of Consumer Protection, stated that the settlement ensures companies are held accountable for collecting data without knowledge or consent. The agreement requires General Motors to obtain affirmative, express consent before collecting or disclosing driving and location data. It also mandates internal and external assessments of data protection programs.

The settlement includes oversight requirements for dealerships to prevent unauthorized enrollment. General Motors agreed to limit the amount of driving data it collects and protect personal information through a comprehensive privacy program. Washington and Oregon co-led the case, with assistance from a committee of other states including Colorado, Connecticut, and Florida. The Smart Driver program was discontinued after media reports on its practices.

The case involved attorneys general from Alabama, Alaska, Arizona, the District of Columbia, Florida, Hawaii, Idaho, Illinois, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, New Jersey, New Hampshire, New York, Nevada, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, Wisconsin, and Delaware. The settlement terms were described as stronger than previous resolutions with General Motors for similar conduct.