GM to Pay $220 Million Over Sale of Driver Data
National News - General Motors has agreed to pay $220 million to settle claims that it sold private details about how and where people drove. Delaware will get $4.72 million dollars of that money, and Maryland will get $7.33 million dollars.
Attorneys general from 36 states took part in the case. Washington and Oregon led it, with Delaware and Maryland serving on the executive committee.
The data came from a GM program called OnStar Smart Driver. Between 2016 and 2024, GM signed up millions of car buyers for it. GM told drivers it would help them drive more safely and said it wouldn't share their data with insurers without their express consent.
The states say GM sold the data to data brokers anyway, and the brokers sold it to insurance companies. Some insurers then used it to help decide what drivers would pay for coverage.
The information was very detailed. Insurers could see how many times a person drove, when each trip started and ended, how often they braked or sped up hard, and whether they went over the speed limit. GM ended Smart Driver in June 2024, after The New York Times reported on it.
Most people were enrolled at a GM dealership when they bought their car. In many cases, dealership workers allegedly accepted the terms and conditions for customers without their consent. At the time, sales staff earned bonuses based partly on how many people they signed up for OnStar, and dealerships were ranked by their numbers.
The OnStar app also allegedly told more than 370,000 drivers they weren't enrolled in Smart Driver when they actually were. GM kept collecting and selling their data. It later allegedly took them out of the program without telling them, and their data stayed with the brokers and insurers.
"Delawareans deserve to be able to trust that companies won't illegally share their private data," said Delaware Attorney General Kathy Jennings. "Today's settlement ensures that GM won't deceive consumers about its data practices in the future. It also highlights why this year's Delaware Personal Data Privacy Act amendments are so important: they help us stop businesses from selling sensitive data, and they're going to be a crucial tool for us as we continue vigorously protecting Delawareans' data privacy."
"Without asking permission, General Motors sold its customers' driving and location data, which, in some cases, was used by insurance companies to set drivers' rates," said Maryland Attorney General Anthony G. Brown. "Because of our settlement, GM can no longer prioritize profit over Marylanders' privacy."
Under the deal, GM has to get a driver's affirmative, express consent before it collects or shares driving and location data. It also has to set up a full data privacy program, limit the driving data it collects, and face regular reviews from inside and outside the company. Dealerships will get new oversight and training rules so no one is signed up for data collection without agreeing to it.
Delaware residents can learn more about their data privacy rights, or file a complaint, at privacy.delaware.gov. GM's response was not part of either announcement.
