DETROIT — In one of the most sweeping data privacy reckonings in the history of the American automotive industry, General Motors has agreed to a monumental $220 million settlement with 36 states and the District of Columbia. The Detroit-based manufacturing giant faced intense, multi-state allegations that it improperly collected, packaged, and monetized the personal driving habits of millions of consumers without their explicit, informed consent—a practice that ultimately triggered skyrocketing auto insurance premiums for unsuspecting vehicle owners.
The sprawling, bipartisan investigation—co-led by the Attorneys General of Washington and Oregon, with critical support from dozens of other states—revealed a systemic corporate failure spanning a full decade. Between 2014 and 2024, GM enrolled millions of drivers into its controversial "Smart Driver" telematics program. While the automaker publicly marketed the service as a benign tool to help motorists improve their driving safety habits and secure potential discounts, investigators found a darker reality: GM was quietly harvesting granular, personally identifiable driving metrics and selling them to third-party data brokers, who in turn funneled the insights directly to major insurance carriers.
The fallout from the scandal has severely bruised GM’s corporate reputation, upended its digital services business model, and triggered sweeping regulatory bans that fundamentally alter how connected vehicles can handle consumer data in the United States.
The Main Facts: What GM Did and How It Affected Drivers
At the core of the multi-state investigation was GM’s "Smart Driver" program, a connected-vehicle feature integrated into millions of Chevrolet, GMC, Buick, and Cadillac vehicles equipped with OnStar technology.
Granular Surveillance
According to state investigators, the data harvested by GM was far from anonymous or generalized. The automaker collected highly specific, personal telematics data that tracked individual driving behaviors in real-time. This included:
- Speeding events: Exact timestamps, locations, and durations of vehicles traveling above posted speed limits.
- Hard braking and acceleration: Frequency, intensity, and geographical coordinates of aggressive vehicle maneuvers.
- Trip timing and routing: The exact dates, times, and destinations of routine commutes and personal journeys.
The Financial Backlash for Consumers
Once collected, this data was sold to major data brokers—most notably LexisNexis and Verisk—which compiled comprehensive risk profiles on millions of drivers. Insurance companies purchased these dossiers to evaluate risk. For thousands of motorists, the hidden surveillance resulted in unexpected, steep increases in their auto insurance premiums, or in some cases, sudden policy non-renewals. Drivers were effectively penalized based on continuous telemetry data they never knowingly agreed to share.
Dealership Pressure and Deceptive Enrollments
The investigation uncovered aggressive, questionable enrollment tactics deployed at the dealership level. Many vehicle buyers were automatically signed up for the Smart Driver program during the complex, high-pressure paperwork phase of a car purchase. Dealership employees frequently enrolled customers without their explicit knowledge or consent—a practice incentivized by GM, which rewarded sales staff with financial bonuses based on high signup volumes.
Furthermore, GM’s software failed to protect consumer choices. The investigation revealed that the automaker’s OnStar mobile application mistakenly informed over 370,000 drivers that they were not enrolled in Smart Driver when, in fact, they were actively being tracked. GM quietly unenrolled these drivers without notifying them or explaining that their previously harvested data remained permanently retained by data brokers.
Chronology of a Scandal: From Silent Tracking to Regulatory Crackdown
The unraveling of GM’s data-harvesting apparatus did not happen overnight. It was the result of investigative journalism, whistleblowers, and a domino effect of state and federal regulatory actions.
- 2014: General Motors launches the "Smart Driver" program, embedding telematics tracking into OnStar-equipped vehicles under the guise of promoting safer driving habits.
- 2014–2024: Over a ten-year period, millions of motorists are enrolled—frequently via dealership manipulation or opaque software prompts—while their driving metrics are compiled and sold to insurance risk-assessment firms.
- April 2024: Following explosive investigative reporting by The New York Times that exposed how automakers were covertly sharing driving data with insurance companies, GM abruptly pulls the plug on the Smart Driver program and severs ties with data brokers LexisNexis and Verisk.
- Mid-2024: State attorneys general across the country launch independent probes. Texas files a formal lawsuit against GM over deceptive trade practices and privacy violations, while California secures a preliminary $12.75 million settlement for state residents.
- January 2025: The U.S. Federal Trade Commission (FTC) officially steps in, issuing a federal ban prohibiting General Motors from selling sensitive consumer driving data to third parties.
- Late 2025 / Early 2026: The multi-state coalition, co-led by Washington and Oregon, culminates its extensive investigation, resulting in the landmark $220 million bipartisan settlement agreement.
Supporting Data and Coalition Scope
The sheer scale of the investigation underscores the growing anxiety among state regulators regarding corporate surveillance and connected-vehicle telemetry. The $220 million settlement represents one of the largest multi-state consumer protection agreements involving an automotive manufacturer in U.S. history.
The legal action was orchestrated by a massive, bipartisan coalition of state attorneys general. While Washington and Oregon spearheaded the probe as lead states, they were joined by an overwhelming majority of jurisdictions, reflecting cross-political consensus on the urgent need to protect digital privacy.
Participating States and Territories:
- Lead Co-Lead States: Washington, Oregon
- Core Supporting States: Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont.
- Additional Participating Jurisdictions: Alabama, Alaska, Arizona, District of Columbia, Florida, Hawaii, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, and Wisconsin.
Official Responses and Accountability
The public condemnation from state leaders was swift and severe, emphasizing that modern vehicles have effectively transformed into rolling data-collection devices that require strict regulatory guardrails.
"Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used," said Washington Attorney General Nick Brown during the announcement of the settlement. "We’re proud to lead this bipartisan agreement holding GM accountable for misusing drivers’ data and deceiving the public about how their personal information was being monetized."
General Motors has maintained a posture of compliance as it moves to resolve the litigation. Under the terms of the new consent decree, the automaker is barred from repeating past practices and must drastically curtail its data collection ambitions.
Moving forward, GM is legally mandated to establish a "comprehensive data privacy program." This framework requires:
- Strict Affirmative Consent: GM must secure explicit, clear, and unambiguous opt-in consent from vehicle owners before collecting or sharing any driving telemetry.
- Dealership Oversight: Implementation of mandatory training programs, monitoring, and compliance protocols for all franchise dealerships to eradicate deceptive enrollment incentives.
- Independent Audits: The appointment of internal and external privacy assessors to regularly audit GM’s data handling, storage, and sharing procedures.
Industry Implications: The Future of the Connected Car
The GM settlement is much more than a localized corporate penalty—it serves as a watershed moment for the entire global automotive industry.
Over the past decade, legacy automakers and tech startups alike have viewed vehicle connectivity as a lucrative secondary revenue stream. As profit margins on hardware manufacturing face constant pressure, executives have increasingly looked to software subscriptions, remote services, and data monetization as the holy grail of recurring corporate revenue. The underlying business model relied heavily on the assumption that consumers would not read the dense, multi-page terms of service agreements flashed across infotainment touchscreens.
The $220 million price tag, paired with aggressive federal FTC bans and escalating state-level lawsuits, has fundamentally shattered that economic calculus. A recent industry study suggests that the reputational damage, legal liabilities, and regulatory penalties associated with selling consumer data far outweigh the short-term financial gains.
For the everyday car enthusiast and modern motorist, the ruling marks a vital step toward reclaiming digital autonomy. Modern vehicles are packed with advanced driver-assistance systems (ADAS), cellular modems, and cloud-connected entertainment suites that generate terabytes of data daily. As cars evolve into smartphones on wheels, the GM settlement establishes a powerful legal precedent: a consumer’s car may belong to them, but the intimate details of how, when, and where they drive do not belong to the manufacturer to sell.
