$220 Million Settlement With General Motors Over Driver Data

Key Facts

Pennsylvania announced on October 29 that a coalition of 36 attorneys general had reached a $220 million settlement with General Motors over allegations that it shared driver data with third parties. The Pennsylvania Attorney General’s Office said the state is expected to receive $8.67 million from the settlement. The case concerns data collected through connected-car services and programs, some of which reached data brokers that sold it to insurance companies. Authorities said insurers used the information in some cases when setting premiums. The settlement sets new obligations for obtaining consumer consent to collect, use and disclose their data.

The agreement resolves allegations that the company sold data on driving behavior and location to third parties, including data brokers that later passed it to insurers. But the settlement order states that it was entered “without any admission of the facts or liability as alleged in the complaint,” so the agreement does not constitute an admission by the company that the allegations are true. This reservation sets legal limits on what the settlement establishes while requiring the company to meet new operational conditions. Those conditions center on giving drivers an explicit choice before covered data is processed. Consent also covers disclosure of that data to a third party, according to the order.

The order defines driving data to include information on braking, acceleration, hard turns, exceeding a set speed threshold, seat belt use and nighttime driving. It also covers the time and duration of trips when those events occur. Location data falls within the definition when it reveals a consumer’s precise location. These categories show the types of details covered by the settlement terms, from a car’s behavior during a trip to its whereabouts. Under the order, General Motors must obtain explicit, affirmative consent before collecting, using or disclosing this data, subject to the specified exceptions.

Some of the allegations concern the Smart Driver program, which Pennsylvania said recorded driving habits. The attorney general’s office said the company enrolled millions of drivers in the program between 2016 and 2024. New York’s attorney general said more than 700,000 state residents were enrolled and that the program tracked driving habits during the same period. The enrollment figures show the program’s reach over time and by number of users, while the settlement focused on how data was obtained and handled. Pennsylvania did not name the brokers that sold the data to insurers in its announcement.

Pennsylvania’s office said broker data could include how often a person drove, when trips began and ended, how often the driver braked or accelerated rapidly, and whether the driver exceeded the speed limit. The office added that the information was sometimes used to change insurance premiums, including raising them. In one case cited by the New York Attorney General’s Office from a New York Times investigation, a driver’s insurance premium rose by 22%, and the driver was told the increase was linked to personal driving information supplied by a data broker. The case illustrates how trip data can move from car services into insurance pricing decisions. The incident remains part of the context presented by authorities, rather than a separate finding in the settlement.

The states’ agreement follows a separate complaint by the Federal Trade Commission, which said its initial announcement came in January 2025. The complaint alleged that the company used a deceptive enrollment process for OnStar and Smart Driver, and failed to tell consumers that it collected precise location and driving behavior data and sold it to a third party without consent. In New York, the attorney general said a single enrollment process was used to sign customers up for the program and service, and that dealership employees allegedly accepted the terms on customers’ behalf in many cases. The states’ settlement adds consent and privacy obligations to this regulatory context. New York’s announcement also provides for an internal data protection and privacy assessment program, along with a third-party assessment and dealership oversight and training requirements.

The settlement order sets November 30, 2026, as its effective date and requires General Motors to establish a comprehensive privacy program within 180 days of that date. The program obligations continue until January 13, 2046, while some provisions of the order expire 10 years after the effective date. The timeline makes privacy compliance an extended obligation beyond payment of the settlement amount. The next step is to establish the program within the specified period, alongside implementing the consent requirement for data covered by the order. These dates and terms are based on the order agreed by the parties.