General Motors will pay $220 million to settle allegations that it sold consumers' private driving behavior data and location information to third parties, including data brokers who then sold the data to insurance companies, Nevada Attorney General Aaron Ford announced.
Nevada will receive $3.77 million through the settlement. The agreement was reached with a coalition of 36 state attorneys general and requires GM to obtain affirmative express consent from consumers before collecting or disclosing driving and location data.
From 2016 to 2024, GM enrolled millions of drivers in its Smart Driver program, which tracked driving habits. The company pitched the service as a way for drivers to improve driving safety and told drivers their data would not be shared with insurers without consent. However, GM sold the information to data brokers under contracts specifying the data was to be used for insurance products. Those brokers then sold it to insurance companies, which used it to adjust drivers' premiums based on their driving habits.
GM did not inform drivers that their data would be sold for insurance purposes. The company's systems also failed to properly notify drivers about data tracking. The OnStar app mistakenly told more than 370,000 drivers they were not enrolled in Smart Driver when they actually were and their data was being collected and sold. GM later quietly unenrolled these drivers without notifying them and left their data with brokers and insurers.
The data included specific details such as how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they exceeded the speed limit. According to Attorney General Ford, "GM told Nevada consumers that their data would not be shared without their consent, only to turn around and sell that same data to brokers."
Under the settlement, GM must limit the driving data it collects from consumers and protect their personal information through a comprehensive data privacy program. The company also agreed to oversight and training requirements at dealerships to prevent enrollment in data collection schemes without consumer consent.