Auto Data Privacy: GM Pays $220 Million for Selling Driver Location Data

The OnStar app told more than 370,000 drivers they were not enrolled in a data tracking program, yet General Motors continued to collect and sell their driving records.

In a settlement announced on Friday, General Motors agreed to pay $220 million to 36 states and the District of Columbia. New York Attorney General Letitia James led the coalition of 35 other attorneys general in the investigation. The state of New York will receive $12,054,341 of the total sum. The funds will support a comprehensive data privacy program that limits the driving data GM collects from consumers.

The case centers on GM’s Smart Driver program, which enrolled millions of drivers between 2016 and 2024. Over 700,000 drivers in New York were part of the initiative. The software tracked specific habits, including the number of times a vehicle was driven, start and end times, rapid braking or acceleration, and instances of speeding. GM marketed the program as a safety tool to help drivers improve their habits. The company told customers they would not share data with insurers without express consent.

Investigators found that GM sold this information to data brokers under contracts specifying its use for insurance products. These brokers then sold the data to insurance companies. Insurers used the driving habits to adjust premiums, often increasing rates for drivers who had not filed any claims. The data sold was personal and identifiable, detailing every trip taken by a customer. One GM owner reported a 22 percent increase in their car insurance premium. An insurance broker attributed the rise to personal driving information provided by a data broker. That driver reviewed a 130-page report showing extensive details about every drive over the previous six months.

Most customers signed up for Smart Driver at GM dealerships during vehicle purchases. The company used a single sign-up process for both Smart Driver and the OnStar service, which provides directions, security, and roadside assistance. Dealership employees accepted the terms and conditions on behalf of customers, often without their consent. GM incentivized dealers to maximize enrollment. From 2020 to 2024, dealership employees received bonuses based partly on how many customers they signed up for connected vehicle services. Dealerships were ranked based on these enrollment numbers.

Attorney General James stated that New Yorkers should not worry about car companies tracking their every move. She noted that GM collected data on personal driving habits without knowledge and then sold it, potentially affecting insurance rates. The settlement requires GM to establish an in-house data and privacy protection assessment program. The company must also undergo third-party data protection and privacy assessments. GM is required to implement oversight and training at dealerships to prevent customers from being enrolled in data collection schemes without consent.

James has pursued other data privacy cases recently. In July 2026, she secured $18 million from 23andMe for failing to protect genetic data. In November 2025, she obtained $5.1 million from Illuminate Education after a student data breach. In October 2025, her office secured $14.2 million from eight car insurance companies for failing to protect the information of more than 825,000 New Yorkers. In March 2025, she secured $975,000 from auto insurer Root and sued Allstate. In January 2025, she secured $450,000 from three companies that distributed home security video cameras.

The coalition includes the attorneys general of Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, Florida, Hawai’i, Idaho, Illinois, Kansas, Kentucky, Maine, Massachusetts, Maryland, Michigan, Mississippi, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, and Wisconsin. For New York, Deputy Bureau Chief Clark Russell handled the matter under the supervision of Bureau Chief Kim Berger. The Bureau of Internet and Technology is part of the Division for Economic Justice, led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Meghan Faux.