Table of Contents
General Motors has agreed to a $220 million settlement with 35 states and the District of Columbia to resolve a major privacy lawsuit concerning the sale of driver data. The dispute centered on the automaker’s Smart Driver program, which dealerships offered to motorists between 2016 and 2024.
The Smart Driver Program Investigation
An investigation published by The New York Times in 2024 revealed that driving habit data collected through the program was utilized by insurance companies to determine rates in certain instances. According to a press release from the New York attorney general’s office, multiple drivers experienced substantial premium increases after General Motors sold their driving histories, with one vehicle owner informed that a 22% premium hike stemmed from driving information provided by a data broker.
The data collection practices were labeled as spying, prompting General Motors to terminate the program that same year. Subsequently, in 2025, the company reached a settlement with the Federal Trade Commission regarding Smart Driver and OnStar location data, which included a five-year prohibition on selling driver data.
State Enforcement and Company Response
Numerous state attorneys general announced the $220 million resolution, including Anthony G. Brown of Maryland. In a press release, Brown stated that General Motors sold customer driving and location data without requesting permission, and noted that insurance companies used this information to establish driver rates in some cases.
Under the terms of the settlement, General Motors must secure affirmative express consent from consumers before collecting or disclosing driving and location data. In an email statement to CNET, a company spokesperson noted that the Smart Driver product ended in 2024 and emphasized that privacy practices have been strengthened since that time.
The spokesperson explained that connected vehicle data enables safer, more helpful, and personalized experiences, and stated that General Motors is dedicated to transparency regarding information usage, protection measures, and customer choices. The company further informed CNET that it has updated and simplified its US privacy statement, established a consumer Privacy Center, and enhanced internal controls for connected vehicle data.
Broader Auto Industry Concerns
Modern automobiles function as computers on wheels, gathering extensive data on drivers such as contact lists, song selections, location data, and diagnostics. For General Motors, the central issue involved breaking its promise to customers by selling data rather than the collection itself.
Peter Cassat, a technology partner at CM Law and former general counsel for Cox Automotive and New Country Motor Group, stated that illegal or unethical data collection is an industry norm rather than an aberration. Cassat noted that regulators now possess a template following the $220 million settlement, which will likely prompt additional enforcement actions and settlements across the industry.
Cassat added that the settlement and ensuing orders represent a positive beginning for auto industry privacy best practices, suggesting that vehicle providers should request driver consent feature by feature in plain English rather than relying on standard checkbox prompts.
Protecting Driver Privacy
Everyday vehicle usage presents data hygiene challenges beyond paperwork signed during purchases, leases, or rentals. Privacy complications can escalate based on smartphone access levels and how drivers utilize location or connectivity features.
Clyde Williamson, a senior security architect at Protegrity, told CNET that protecting personal data in modern cars can prove extremely tricky. Williamson explained that modern vehicles carry privacy risks comparable to smartphones, potentially without receiving equivalent security attention from manufacturers. While public scrutiny has targeted smart devices like televisions, automobiles have not faced the same level of examination, and drivers have limited options to shield their data without sacrificing key conveniences.
Williamson advised that consumers have few direct actions available, recommending that drivers opt out wherever possible, avoid unnecessary data sharing, review their Customer Disclosure Report for driving data, and consider disabling the car modem if applicable.
