Image credit: General Motors
General Motors will pay $220 million to settle allegations that it collected information about how customers drove their cars and sold it to data brokers, which then passed the information to insurance companies. Attorneys general from 35 states and Washington, D.C., brought the case, led by Oregon and Washington state.
The data sometimes led to higher insurance premiums, but affected drivers won't receive any of the settlement money. A nationwide private class-action lawsuit seeking compensation for car owners remains pending.
If you were one of the millions of drivers who enrolled in GM's Smart Driver program between 2016 and 2024, your braking and speeding habits may have reached your insurer. Insurers could see how many trips a driver took, when each trip started and ended, how often the driver braked or accelerated hard, and whether the driver exceeded the speed limit. They used that information in part to set insurance rates, sometimes raising premiums.
Oregon says that most drivers were signed up for Smart Driver at the dealership when they purchased their cars, through the same sign-up process used for OnStar. Dealership employees sometimes accepted the terms and conditions on customers' behalf without their consent, and sales staff earned bonuses partly based on how many customers they enrolled.
More than 370,000 drivers were told by the OnStar app that they weren't enrolled in Smart Driver, even though GM was still collecting and selling their driving data. Oregon claims GM later unenrolled those drivers without disclosing the error, leaving their information with data brokers and insurers.
GM did not admit wrongdoing in the court judgment. It's disappointing that drivers whose insurance rates may have increased won't receive compensation through this settlement. Still, the agreement requires GM to adopt stronger privacy protections going forward.
Starting November 30, when the judgment takes effect, GM must get separate, clearly explained consent before collecting or sharing driving behavior and location data. Dealership staff must be trained so customers can review privacy disclosures before enrolling in OnStar, and GM must provide an easy way for drivers to request deletion of their data.
GM must also delete driving and location data it retained from before January 16, 2025. GM can ask customers for permission to keep older data. It must also ask third parties that previously received driving data to delete it, although legal requirements may allow some information to be retained.
What GM drivers can do now
If you owned a GM vehicle while Smart Driver was operating, you can use GM's U.S. Consumer Privacy Request Form to find out what information it collected about you or request that it be deleted. Select "Access my Personal Information" to review your data, or "Delete my Personal Information" to request its removal. I recommend requesting access first, so you can see what information GM still holds before asking for deletion.
For information already sold to LexisNexis and Verisk, you can request a copy of your file from each company. You can request your LexisNexis file at its consumer portal and your Verisk file through its Driving Behavior Data Disclosure Form. Verisk says it stopped receiving GM driving data in March 2024 and no longer provides driving behavior history reports to insurers.
