Privacy / Regulation / Data Quality
GM agrees to pay $220 million to 36 attorneys general over sale of driver data to insurers via brokers
The settlement requires affirmative express consent before GM collects or discloses driving and location data, plus data minimisation and a privacy programme subject to internal and external assessments.
General Motors will pay $220 million to settle allegations by a coalition of 36 attorneys general, co-led by Washington and Oregon, that it sold drivers’ behaviour and location data to data brokers, who passed it to insurers. According to the Washington Attorney General, insurers used the data in part to set rates.
The investigation found that GM enrolled millions of drivers in its Smart Driver programme between 2016 and 2024, often at dealerships through a combined OnStar sign-up. GM sold the data under contracts specifying insurance use, without telling drivers. The OnStar app wrongly told over 370,000 drivers they were not enrolled; GM later unenrolled them quietly and left their data with brokers and insurers.
GM must now obtain affirmative express consent, limit collection, run a comprehensive privacy programme with internal and external assessments, and train dealership staff. A separate Texas lawsuit is ongoing.
Why it matters
The case shows regulators treating gaps between consent records, app status displays and actual data flows as a core violation, not a technical slip: GM's systems told 370,000 drivers they were not enrolled while data was being sold. Organisations sharing telematics or behavioural data should reconcile enrolment flags across front-end apps and back-end systems, and check that contracts with downstream recipients match what customers were told. Consent captured by intermediaries such as dealers or resellers is a specific risk area the settlement now targets with oversight and training duties.
Status: Decision. Settlement of allegations; separate Texas lawsuit against GM is ongoing
What to check
- Verify that consent or enrolment status shown to customers in apps matches the status held in the systems that actually collect and share their data.
- Review data-sharing contracts with brokers or partners to confirm the stated downstream uses, such as insurance pricing, were disclosed to the individuals concerned.
- Check whether third parties such as dealers or sales staff can accept terms or enrol customers on their behalf, and whether incentives encourage this.
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Settlement
- Authority
- 36 US state attorneys general (co-led by Washington and Oregon)
- Concerning
- General Motors
- Amount
- USD 220m
Case status: Closed · 2 steps
Enforcement trackerWho should care
- DPO
- Legal & compliance
- Data stewards
- CDO