General Motors has agreed to pay $220 million to settle a data privacy lawsuit brought by the attorneys general of 35 US states and the District of Columbia. The case centers on a powerful question: how much can a company learn, share, and sell about the way people drive without their clear permission?
The settlement closes claims tied to GM’s OnStar Smart Driver program, which the automaker ended in 2024. It also pushes driver privacy into a larger fight over connected products, personal data, and the growing number of devices that can observe people in everyday life.
What GM’s Smart Driver Program Tracked
Customers could enroll in Smart Driver when they purchased a car at a dealership. The program tracked their driver safety record and encouraged safer practices, but the states accused GM of selling enrolled drivers’ information and driving data to data brokers without their knowledge.
Those data brokers then sold the information to insurance companies. The alleged activity took place from 2016 through 2024, and the information was not a vague profile. Washington state Attorney General Nick Brown said the data was “personal, identifiable, and specific.”
Insurers had access to details that could map a person’s driving habits, including:
- How many times a person drove their vehicle
- The start and end times of each drive
- How many times the driver braked quickly
- How many times the driver accelerated quickly
- Whether the driver went faster than the speed limit
Brown also said that when users tried to check their Smart Driver enrollment, GM’s OnStar app incorrectly told more than 370,000 drivers that they were not enrolled when they actually were. That mistake added another layer to the dispute: drivers could not make informed choices about a program the app failed to identify correctly.
Some drivers discovered in March 2024 that their insurance rates had increased without any accidents. Others had trouble obtaining an insurer at all because of driver data provided by GM. The allegations turned routine driving records into information that could affect household costs and access to insurance.
Settlement Ends One Program, Not Every Dispute
GM did not admit wrongdoing in the settlement. A GM spokesperson said the agreement strengthens existing privacy practices and addresses Smart Driver, “a product we ended in 2024.” The spokesperson also said GM is committed to being clear about what information it uses, how that information is protected, and what choices customers have about what they share.
The coalition was led by Oregon Attorney General Dan Rayfield and Nick Brown of Washington state. Several state attorneys general promoted the ruling on social media, including Ohio’s Andy Wilson, Virginia’s Jay Jones, Colorado’s Phil Weiser, and New York’s Letitia James.
Jones wrote, “My office is proud to defend Virginians’ privacy rights,” a message that captures the larger stakes of the case. Connected cars can turn ordinary trips into detailed records, and regulators are pressing companies to explain when those records become commercial products.
The Federal Trade Commission took action against GM in January 2025 after revelations about Smart Driver. The FTC banned GM from disclosing certain driver data to consumer reporting agencies for five years and required GM to give consumers a way to request deletion of their data.
Texas sued GM in 2024 over the program and was not part of the latest settlement. That lawsuit is ongoing, leaving the automaker with another unresolved legal challenge tied to Smart Driver.
Privacy Questions Spread Across Connected Devices
The GM case arrives as lawmakers examine privacy risks in another category of connected hardware: Meta’s AI smart glasses. US Senators Ron Wyden and Edward Markey are investigating what they called “serious privacy and safety risks” around the product, and they wrote to Mark Zuckerberg after Meta launched the glasses despite identifying risks to bystander privacy.
The senators pointed to incidents involving men secretly filming women with Meta’s “pervert glasses” while harassing them, then posting the recordings to social media. They also cited reports and a lawsuit alleging that Meta’s AI contractors reviewed footage showing people undressing and engaging in sexual activity.
Wyden and Markey asked Meta to answer specific questions about accidental camera activation and tampering with recording indicators. They also want to know whether the glasses blur faces and license plates during certain AI interactions, as Meta does on Facebook and Instagram, and when captured imagery becomes accessible to employees or contractors or gets used to train AI models.
The senators asked whether Meta conducted detailed human rights due diligence and safety testing before releasing the glasses. They requested responses by Thanksgiving, November 26, 2026. Users have also said the glasses recorded their conversations without consent after a firmware update, while the devices have been spotted on ICE agents during raids. New York City’s police counterterrorism unit raised surveillance concerns in January this year.
Earlier in October, California Governor Gavin Newsom vetoed a bill that would have banned people from using wearables to secretly record others in private areas of businesses. Wyden and Markey told Zuckerberg, “Meta’s professed commitment to privacy and preventing intimate image abuse rings hollow if the company cannot demonstrate meaningful steps to prevent its own products and practices from facilitating those harms.”
A separate landmark court order from New Mexico requires Meta, the company operating Facebook and Instagram, to pay $25 billion in civil penalties linked to the 2018 Cambridge Analytica scandal. That scandal exposed nearly 87 million Facebook users’ data, while New Mexico Attorney General Raúl Torrez said a breach affected over 350,000 New Mexicans whose personal information was brokered or sold unknowingly to a political consulting firm.
From connected cars to AI glasses and social platforms, the message is gaining force: privacy controls must match the power of the technology collecting the data. GM’s settlement, the FTC’s five-year restriction, and the investigations into Meta show regulators and lawmakers demanding clearer answers before personal information becomes someone else’s business.
Based on
- General Motors agrees to pay $220 million to settle multi-state data privacy lawsuit — engadget.com
- General Motors to pay $220M to settle driver data lawsuit — thehill.com
- Senators Are Looking Into ‘Serious Privacy Risks’ With Meta’s AI Glasses — engadget.com
- Am I getting money from Meta’s $25 billion privacy fine? Who is? — usatoday.com
