Security News

GM Pays $220 Million to Settle Claims It Sold Drivers' Location and Behaviour Data

The Record · 30 Oct 2026
Key Takeaway If your business uses connected vehicles or telematics services, review what data they collect and who it is shared with, and read consent terms carefully before signing.

General Motors has agreed to pay $220 million to settle a lawsuit brought by a coalition of 36 US state attorneys general. The states alleged the company unlawfully sold customers' location and driving behaviour data to outside parties, including data brokers. According to Washington Attorney General Nick Brown, who co-led the effort, those brokers then sold the data to insurers, which affected the prices drivers were charged for insurance.

The lawsuit alleges that from 2016 until 2024, when the New York Times exposed the practice, GM enrolled millions of people in its "Smart Driver" program. It was allegedly promoted as a way to improve driving safety, and customers were allegedly promised their data would not go to insurers without their consent. The suit claims GM sold the data anyway and did not tell customers. Many people signed up at dealerships while buying a car, and some have described pressure tactics. Enrolment also brought them into GM's OnStar services.

As part of the settlement, GM must obtain affirmative express consent before collecting or sharing driving behaviour and location data. A GM spokesperson said the agreement covers Smart Driver, a product the company ended in 2024, and that GM is committed to being clear about how data is used, protected and controlled by customers.

data privacy connected vehicles data brokers regulation consent
Answering to more than one framework? Run them as one security and AI governance programme ->

Summarised by CISO AI from The Record, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.