GM to Pay $220 Million Over Unauthorized Smart Driver Data Sharing

General Motors has agreed to pay $220 million after a multi‑state lawsuit found the company’s Smart Driver system shared location and driving‑behavior data with third‑party brokers. Those brokers then sold the information to insurance companies, and some drivers saw their premiums rise without ever agreeing to that use of their data.

Settlement details and enforcement

The settlement was reached after the District of Columbia and 35 states sued GM for violating driver privacy. According to the Ars Technica report, the agreement requires GM and its OnStar subsidiary to stop sharing geolocation and driver‑behavior data with any third party for five years. A third‑party auditor will be tasked with confirming compliance, which means the companies cannot rely on their own statements alone.

The payment of $220 million will be distributed among the participating states and the District of Columbia. The amount reflects both the alleged harms to drivers and the cost of the investigation that uncovered the data‑selling practice. GM’s public comment, quoted by Reuters, emphasized that “safer, more helpful and personalized experiences are enabled by connected vehicle data,” and promised clearer choices for customers.

How the data was used and why it matters

Smart Driver was marketed as a parental‑monitoring and driver‑behavior tool. In 2024, it became clear that GM was not only providing the data to its own services but also passing it on to data brokers. Those brokers packaged the information and sold it to insurance carriers, who then used the details to adjust rates. Some drivers reported higher premiums and said they never consented to that sharing.

The practice raises two main concerns for small‑business owners and nonprofit staff who rely on company‑provided vehicles. First, the loss of control over location data can expose travel patterns that reveal business operations, client visits, or supply‑chain routes. Second, higher insurance costs can affect budgeting for fleets, especially when the increase is tied to data that owners did not knowingly share.

Impact on drivers, insurers and the broader auto industry

The settlement sends a clear message that automakers must treat driver data with the same care as personal financial information. For drivers, the immediate effect is the potential for lower insurance premiums if insurers can no longer rely on unauthorized data. Insurers, meanwhile, will need to adjust underwriting models to use only data obtained with explicit consent.

Industry analysts note that the FTC settlement last January already forced GM to discontinue Smart Driver across its entire lineup. The new state‑level settlement reinforces that move and adds an external verification step. While the auto sector continues to roll out connected‑car features, this case shows that privacy safeguards will become a key part of product design and marketing.

Practical steps to protect your vehicle data

If you or your organization uses connected‑car services, consider the following actions to keep driver data private:

• Review the privacy settings in your vehicle’s infotainment system or mobile app. Look for options to disable location sharing or data collection for marketing purposes.
• Opt out of data‑broker agreements where possible. Some manufacturers provide a simple toggle in the user portal.
• Contact your insurance provider to confirm what data they use for rate calculations. Request that only data you have explicitly shared be considered.
• Keep software updates current. Manufacturers often include privacy‑related fixes in firmware releases.
• Document any consent you give. If a service asks you to agree to data sharing, save a copy of the terms so you can reference them later.

By taking these steps, you reduce the risk that your driving habits or routes are sold to third parties without your knowledge.

If you need help auditing the data practices of your connected‑car fleet or want to build a privacy‑first solution, Need a web app, plugin, or integration built to last? Our team can guide you through best‑practice implementation and compliance.

What to watch next

The third‑party auditor will begin its review in the coming months. Watch for any additional findings or required corrective actions that GM may need to implement. Keep an eye on future FTC guidance, as the agency may issue broader rules for connected‑vehicle data across the industry. For small businesses, staying informed about how vehicle data is used will be an ongoing part of risk management.

Overall, the GM driver data settlement highlights the importance of transparency and consent in the era of connected technology. By understanding the risks and taking proactive steps, you can protect both your privacy and your bottom line.