GM’s Connected-Car Data Deal Puts Privacy Under the Microscope

General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location information to data brokers. The agreement reaches across 35 states and the District of Columbia, and it forces GM to place express consent at the center of its connected-car data practices.

The settlement also adds a safeguard that reaches beyond GM’s own promises: a third party must assess whether the automaker follows the privacy program it has put in place. That requirement gives the agreement real teeth, especially after data from the company’s Smart Driver program reached insurance providers and could affect customers’ rates.

Smart Driver Turned Everyday Driving Into Valuable Data

Smart Driver was a free feature inside GM’s connected car apps. It tracked and rated driving behavior and seat belt use, creating records that included hard braking, late-night driving, speeding, and other details about how people drove.

GM collected the data from 2016 through 2024, then sold it to data brokers. The lawsuit alleged that those brokers, including LexisNexis and Verisk, sold the information to insurance providers, which used it in ways that could raise premiums for drivers.

The attorneys general alleged that GM did not clearly tell customers their data would be sold for insurance purposes. They also said many drivers were not told they had joined the program at all, while dealerships received bonuses for signing up as many customers as possible.

According to the allegations, dealership employees sometimes accepted Smart Driver terms and conditions for customers without their express permission. More than 370,000 drivers were told they were not enrolled even though they were. GM later removed those drivers from the program, but did not notify them about the mistake and continued selling their data.

The attorneys general described the information as “personal, identifiable and specific,” a phrase that captures the core issue: connected vehicles can turn ordinary trips into detailed records about a person’s habits, movements, and choices.

New Rules Put Consent and Oversight First

Under the settlement, GM must get drivers’ express consent before collecting or sharing their driving and location data. The company must also limit the driving information it collects, protect customers’ personal information, and strengthen privacy oversight inside its business.

• GM must obtain express consent for certain data collection and sharing.
• The automaker must limit the driving data it collects from customers.
• A third party must assess compliance with GM’s privacy program.
• GM faces internal and external data protection and privacy assessments.
• Dealerships must receive oversight and additional training.

The settlement terms align with separate agreements GM reached with California and the Federal Trade Commission. California’s agreement, reached in May, required GM to pay $12.75 million.

In January, the FTC finalized an order banning GM and its OnStar telematics service from sharing certain consumer data with third parties for five years. That agreement covers geolocation data and driver behavior data, and it requires GM to be more transparent while receiving explicit consent for certain collection.

GM discontinued Smart Driver across its entire range in 2024. The company has also updated its privacy policy and created a consumer-facing Privacy Center, giving customers a place to review what information is used, how it is protected, and what choices they have about sharing it.

GM Promises a Different Path for Connected Vehicles

GM said the agreement addresses Smart Driver, “a product we ended in 2024,” and reinforces steps it has taken to strengthen its privacy practices. The company also said it will no longer sell vehicle information that can be linked to an individual, their vehicle location, or how they drive.

GM may still disclose anonymized data that is not tied to an individual with certain partners. That distinction matters as the automaker pushes connected vehicle services, including AI features such as an assistant that can control vehicle functions, answer questions, and help plan routes.

“Safer, more helpful and personalized experiences are enabled by connected vehicle data,” GM said, adding that it is committed to being clear about what information is used, how it is protected, and the choices customers have about what they share.

That promise now faces outside review. The settlement does not leave compliance to GM’s word alone; a third party will assess whether the privacy program works as required. The automaker must also maintain mandated internal and external assessments, dealership training, and data protection controls.

The case arrives as GM presents itself as a technology company, adds AI features to vehicles, and relies on connected data to make driving experiences more helpful and personalized. Those ambitions depend on customer trust. With the Smart Driver settlement, GM now has to prove that convenience and personalization can move forward without turning private driving behavior into an unseen product.

Stay connected via Google News

Follow us for the latest AI News