GM Privacy Deal: $220 Million Settlement and New Data Rules

Drivers in Mississippi will receive $3,607,640 as part of a $220 million settlement announced by Attorney General Lynn Fitch on Sunday. The payment comes from a broader agreement between General Motors and a coalition of 36 state attorneys general. The settlement addresses how the automaker collected and sold location and driving data from its Smart Driver program.

The states found that GM misled consumers about the purpose of the Smart Driver tool. From 2016 to 2024, the company enrolled millions of drivers in the program, which tracked driving habits. GM told customers the tool was designed to improve safety and assured them that data would not be shared with insurers without express consent.

Attorney General Fitch stated that GM sold sensitive location and driving data to third-party data brokers without obtaining that consent. The contracts with these brokers specified that the data was to be used for insurance products. Insurance companies then used the driving data to adjust premiums. Fitch said the coalition would hold companies accountable for violating consumer trust.

A specific error in the OnStar app compounded the issue. The application mistakenly told more than 370,000 drivers that they were not enrolled in the Smart Driver program. In reality, GM was collecting and selling their data. The company later unenrolled these drivers quietly, without notifying them of the mistake, and left the existing data with the brokers and insurers.

The settlement requires GM to obtain affirmative express consent from consumers before collecting or disclosing driving and location data. The terms also mandate that GM limit the amount of driving data it gathers and protect personal information through a comprehensive data privacy program. The agreement requires internal and external assessments of data protection and privacy programs.

GM must also implement oversight and training requirements at its dealerships. These measures are intended to protect consumers from being enrolled in data collection schemes without their consent. The settlement was reached with Fitch and the attorneys general of Washington, Oregon, Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, Vermont, Alabama, Alaska, Arizona, the District of Columbia, Florida, Hawai’i, Idaho, Kansas, Maine, Massachusetts, Michigan, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, and Wisconsin.