GM pays $220 million settlement over driver‑data sharing practices.

General Motors Corp has agreed to pay a $220 million settlement to resolve a multi‑state lawsuit accusing the automaker of illegally selling detailed driver‑behaviour and location data to third‑party data brokers. The settlement, announced on Wednesday, brings to an end a complaint filed by a coalition of 36 state attorneys general who argued that GM had breached privacy laws by collecting and distributing information about how its customers drove and where they travelled without obtaining proper consent. Under the terms of the agreement, GM will be required to overhaul its data‑collection practices, limiting the scope of information it gathers and ensuring that drivers provide explicit permission before any personal driving data is recorded or shared.The controversy centred on GM’s now‑defunct Smart Driver programme, which was launched in 2019 as a telematics service intended to give owners insights into fuel efficiency, vehicle health and driving style..

Participants in the programme consented to the transmission of vehicle data to GM’s servers, but the settlement alleges that the company went beyond the scope of that consent, aggregating granular data points such as acceleration rates, hard braking events, speed, mileage and GPS‑derived location tracks. According to the attorneys general, GM then supplied these datasets to external data brokers, who in turn sold the information to insurance firms, marketing agencies and other commercial entities seeking to assess risk or target consumers. Critics say the practice enabled insurers to price policies based on real‑time driving behaviour rather than traditional underwriting criteria, raising concerns about fairness and the potential for discriminatory pricing.In its filing, the coalition of attorneys general claimed that GM’s actions violated a range of state consumer‑privacy statutes, including the California Consumer Privacy Act and similar laws in Illinois, New York and Washington..

The complaint asserted that GM failed to provide clear notice of its data‑sharing practices, did not offer a meaningful opt‑out mechanism, and lacked the “express consent” required by many jurisdictions before collecting or selling personally identifiable information. While GM has maintained that it complied with all applicable regulations, the company acknowledged that its privacy disclosures could have been more transparent and agreed to the settlement without admitting wrongdoing.The $220 million figure represents the largest civil penalty ever imposed on an American automaker for a data‑privacy violation, according to the coalition’s spokesperson. The payment will be distributed among the participating states, with each attorney general receiving a proportionate share based on the size of their jurisdiction and the extent of alleged harm to residents..

In addition to the monetary component, the settlement includes a series of non‑monetary remedies designed to prevent future infractions. GM must submit to an independent audit of its data‑handling practices, implement a comprehensive privacy programme overseen by an external compliance officer, and publish regular reports detailing how driver data is collected, stored and shared.Industry analysts say the case underscores the growing tension between the automotive sector’s push toward connected‑car technologies and the evolving legal landscape governing personal data. Modern vehicles are equipped with an ever‑increasing array of sensors that generate massive streams of information, from simple engine diagnostics to high‑resolution maps of a car’s surroundings..

While manufacturers argue that this data can improve safety, reduce emissions and enable new services, regulators and consumer‑advocacy groups warn that insufficient safeguards could expose drivers to unwanted surveillance and exploitation.The settlement also comes at a time when several other automakers are facing scrutiny over similar practices. In early 2024, a separate lawsuit accused a major European carmaker of sharing location data with law‑enforcement agencies without proper warrants, while a US‑based electric‑vehicle startup settled a class‑action claim for failing to secure driver consent before transmitting telemetry to a cloud platform. These cases reflect a broader trend of heightened enforcement of privacy statutes across state lines, prompting companies to reassess how they design and market telematics features.Legal experts note that the requirement for “express consent” will likely reshape the way automakers structure user agreements..

Rather than burying consent clauses in dense terms‑of‑service documents, companies may need to adopt more interactive, user‑friendly prompts that clearly explain what data will be collected, how it will be used and with whom it may be shared. Failure to meet these standards could invite further litigation, especially as courts continue to interpret the scope of state privacy laws in the context of emerging technologies.GM’s chief legal officer, who declined to comment on the specifics of the settlement, issued a brief statement saying the company is “committed to protecting the privacy of our customers and will implement the changes required under the agreement.” The automaker also announced that it will discontinue any remaining data‑sharing arrangements that do not meet the newly established consent thresholds, and will offer existing Smart Driver participants the option to delete their historical data or opt out of any future collection.Consumer groups have welcomed the settlement as a step forward for driver privacy, though some caution that enforcement will be the true test of its effectiveness. “Financial penalties are important, but the lasting impact will come from the mandated changes to GM’s data‑handling practices,” said a spokesperson for the Electronic Privacy Information Center..

“If the company follows through on the audit and reporting requirements, it could set a benchmark for the entire industry.”The case highlights the broader societal debate over how much personal data individuals are willing to trade for the conveniences of connected technology. As vehicles become increasingly software‑driven, the line between a car and a data‑generating device continues to blur, prompting regulators to adapt long‑standing consumer‑protection frameworks to a new digital reality. The outcome of GM’s settlement may serve as a template for future disputes, signalling that corporations can no longer assume that drivers will passively relinquish their data without clear, informed permission..