# GM Settles Driver Data Lawsuit for $220 Million, Mandates Stricter Privacy Controls A coalition of 36 state attorneys general has secured a $220 million settlement from **General Motors (GM)**, concluding a lawsuit alleging the automotive giant illegally sold consumers' location and driving behavior data to third parties, including data brokers and subsequently, insurers. The settlement, co-led by Washington Attorney General **Nick Brown**, marks a significant moment for automotive data privacy. ## The "Smart Driver" Controversy From 2016 through early 2024, **GM** allegedly enrolled millions of drivers into its "Smart Driver" program. While marketed as a tool to enhance driving safety, the program also allowed **GM** to monitor driving habits extensively. The lawsuit claims that **GM** then sold this sensitive data to data brokers, who, in turn, provided it to insurers, often without the explicit consent or knowledge of the drivers involved. ### Deceptive Practices and Lack of Consent The core of the allegations centers on deceptive practices. Drivers were reportedly pressured into enrolling in Smart Driver at dealerships, often as part of the car purchasing process, which also swept them into **GM**'s **OnStar** services. Dealership employees allegedly received bonuses and incentives based on enrollment numbers. Crucially, **GM** allegedly promised customers that their data would not be shared with insurers without affirmative consent. However, the lawsuit contends that **GM** broke this promise, selling the information despite contract language indicating brokers' intent to profit by providing the data to insurers. Furthermore, over 370,000 customers were mistakenly informed their data was not being monitored, only for **GM** to secretly unenroll them later without alerting them to the prior data collection. ## Fallout and Settlement Terms The practice came to light following an exposé by the *New York Times* in April 2024, leading to widespread public outcry and the eventual shutdown of the Smart Driver program by **GM**. In addition to the $220 million fine, the settlement imposes stringent requirements on **GM**: * **Affirmative Express Consent:** **GM** must now obtain affirmative express consent from customers before collecting or sharing driving behavior and location data. * **Data Minimization and Safeguards:** The company is required to minimize the driving data collected from consumers and implement a comprehensive data privacy program to safeguard information. * **Enhanced Oversight and Training:** **GM** must augment oversight and training for dealership employees to ensure customers are not enrolled in data collection programs without explicit approval. * **Internal and External Assessments:** The settlement mandates internal and external data protection and privacy program assessments, terms described as "significantly stronger than any other resolution reached with **GM** for this conduct." ## Ongoing Legal Battles While this settlement addresses a significant portion of the claims, a similar lawsuit filed by Texas Attorney General **Ken Paxton** in 2024 is still ongoing. **Paxton** has alleged **GM** handled drivers’ data in a "false, deceptive, and misleading" way and is seeking a jury trial, civil penalties of up to $10,000 per offense, and a court order for **GM** to delete collected data. **GM**, in a statement, indicated that the agreement addresses a product they ended in 2024 and reinforces steps taken to strengthen their privacy practices. They affirmed their commitment to clarity regarding information usage, protection, and customer choices in sharing data for "safer, more helpful and personalized experiences" enabled by connected vehicle data.