23 Daily — According to theverge.com, General Motors (GM) has agreed to pay 20 million to settle allegations that it illegally sold driver behavior and location data to data brokers. The settlement resolves complaints from a coalition of 36 U.S. state attorneys general and requires GM to limit the driving data collected and obtain "express consent" from drivers prior to data collection.
Multistate Legal Action Over Illegal Data Sales
The case involves GM’s now-discontinued Smart Driver program, which collected data on driving habits such as acceleration, braking, and trip length. GM is accused of passing this information to data brokers, allowing insurance companies to purchase the data and subsequently raise insurance premiums. States also alleged that GM failed to notify drivers about enrollment in the program and data collection activities.
GM Commits to Enhanced Privacy Practices and User Choices
GM spokesperson Charlotte McCoy stated via email that the settlement concerns the Smart Driver product, which ended in 2024, and underscores steps taken to strengthen privacy practices. She noted that connected vehicle data enables safer and more personalized experiences, and GM is committed to transparency regarding data usage, protection, and customer choices on data sharing.
Attorneys General Highlight Consumer Rights Violations
The legal action, co-led by Oregon Attorney General Dan Rayfield and Washington Attorney General Nick Brown, includes participation from states such as New York, Florida, Michigan, Nevada, and Pennsylvania. Rayfield commented, “People bought a car, not a tracking device. GM told drivers this program would help them drive more safely and promised it wouldn’t share their data with insurers without permission. Our investigation found GM sold that data anyway, and some drivers paid for it with higher premiums.” Previously, GM agreed to pay
Editor's take: Data privacy management is critical in connected vehicle ventures
The substantial settlement paid by GM highlights the legal and ethical challenges of data collection and use in the automotive industry. For entrepreneurs developing products or services involving sensitive user information, obtaining explicit consent before data collection and maintaining transparency about data use are imperative to avoid high penalties and reputational damage. Validating privacy policies through user research and compliance audits can help prevent similar legal risks.