General Motors sold drivers’ data and is now paying a hefty fine
General Motors has agreed to pay $220 million, or approximately €190 million, to settle a dispute over the sale of drivers’ personal data. For years, the carmaker collected information about customers’ driving habits and movements and sold it to data brokers, who passed it on to insurers. Some drivers saw their insurance premiums rise significantly as a result, even though they had not given informed consent for their data to be used in this way.
The car tracked every braking and acceleration event
According to the New York Attorney General’s Office, General Motors reached a settlement with the attorneys general of 36 US states and the District of Columbia.
The investigation found that GM collected data on millions of drivers through its Smart Driver programme between 2016 and 2024. The system recorded trip start and end times, routes travelled, harsh acceleration and braking, and instances of speeding. GM presented the programme as a way to improve driving safety, but sold the information it collected to data brokers whose clients included insurance companies. Those insurers could use the data to calculate premiums.
Drivers may not even have known they were being tracked
How customers were enrolled in Smart Driver proved particularly problematic. Many car owners signed up for the programme alongside OnStar services when buying their vehicles.
Investigators said dealership staff in some cases accepted the terms on customers’ behalf. GM encouraged dealers to enrol as many users as possible by offering financial bonuses. More telling still, the OnStar app incorrectly showed more than 370,000 drivers that they were not participating in the tracking programme. In fact, GM was collecting and selling their driving data.
According to an earlier investigation by The New York Times, one GM owner’s insurance premium rose by 22% after their driving data was used. A report compiled on that driver contained 130 pages of detailed driving history.
Settlement forces GM to change its use of data
In addition to the €190 million payment, GM must now obtain explicit consent from drivers before collecting or sharing driving and location data.
The company must limit the amount of information it collects, strengthen data protection and introduce independent oversight. Dealerships will face additional training and oversight requirements.
GM ended the Smart Driver programme in 2024. The new settlement does not provide direct compensation for affected drivers, but a separate class action remains pending.
Could the same happen in Europe?
The case highlights a broader problem: a modern car is no longer merely a means of transport, but a computer system that constantly collects data. Connected vehicles can record locations, driving speeds, braking and driving habits. Such information is valuable to insurers seeking to assess each driver’s risk more accurately.
In Europe, the General Data Protection Regulation, or GDPR, imposes strict requirements on the processing of such information. There must be a lawful basis for collecting and sharing data, and users must receive clear information about how it is used. Where consent is relied upon, it must be informed and freely given.
The main lesson from the GM case is simple: buying a car should not mean handing over information about driving habits to third parties. In the era of connected cars, data protection is becoming as important an indicator of a manufacturer’s trustworthiness as reliability and safety.
