General Motors to pay $220 million to 36 states to settle allegations of illegal driving data sales

General Motors has reached a landmark $220 million settlement with a coalition of 36 states, bringing a definitive close to protracted legal battles regarding the automaker’s unauthorized collection and sale of sensitive driver behavior and geolocation data. The agreement mandates rigorous new oversight protocols and ensures that the company must obtain explicit, informed consent from vehicle owners before harvesting or sharing telematics data with third parties. This settlement serves as a significant regulatory milestone in the automotive industry, signaling an end to an era of opaque data harvesting practices that flourished as vehicles became increasingly connected.

A Chronology of Data Privacy Controversies

The seeds of this legal conflict were sown well before the formal filing of the multistate lawsuit. The controversy gained widespread public attention in early 2024, following an investigative report by The New York Times. The report detailed how GM’s “Smart Driver” program—a feature embedded within its connected car applications—had been silently collecting and transmitting granular driving metrics, including speed, braking patterns, and seat belt usage, to data brokers such as LexisNexis and Verisk.

These brokers subsequently repackaged and sold this telematics data to insurance providers. The implications were immediate and severe: consumers reported unexpected spikes in their insurance premiums, often without realizing that their own vehicles were effectively serving as surveillance devices reporting their habits to insurers.

Following the public outcry, the regulatory landscape shifted rapidly. By January 2026, the Federal Trade Commission (FTC) finalized an enforcement order against GM and its OnStar subsidiary, prohibiting the sale of specific consumer data and mandating stricter disclosure requirements. The current $220 million settlement with 36 states acts as the latest, and perhaps most punitive, layer of this regulatory framework, requiring not just policy changes but also third-party audits of the company’s internal privacy architecture.

The Mechanics of the Settlement

Under the terms of the agreement, GM is strictly prohibited from selling or sharing vehicle data that could be linked to an individual’s identity, location, or specific driving behavior without obtaining express consent from the customer. The settlement goes beyond mere promises; it requires the company to undergo independent, third-party assessments of its privacy program to ensure compliance with the newly established standards.

In addition to the financial penalty, the settlement mirrors the requirements of previous agreements with the FTC and the State of California. The mandate for third-party oversight is a critical component, designed to prevent the "self-policing" failures that led to the original privacy breaches. GM has also committed to creating a consumer-facing Privacy Center, an interface intended to allow users to manage their data permissions with greater granularity and transparency.

Corporate Response and Pivot

General Motors has officially retired the Smart Driver program, a move the company says was completed in 2024. In an emailed statement following the announcement of the settlement, a company spokesperson emphasized that the agreement addresses a legacy product and reinforces the automaker’s commitment to modern privacy standards.

"Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share," the statement read. The company further noted that it has fundamentally altered its data management strategy, stating that it will no longer sell vehicle information linked to an individual’s identity or specific driving patterns. However, the company clarified that it may continue to disclose anonymized, aggregate data to third-party partners for research and development purposes.

The Broad Implications for the Connected Vehicle Market

The $220 million settlement arrives at a time when the automotive industry is undergoing a "software-defined" transformation. Modern vehicles are no longer merely mechanical machines; they are sophisticated computing platforms capable of constant communication with cloud servers. As automakers lean into artificial intelligence and integrated digital ecosystems—such as calendar syncing, messaging, and AI-driven roadside assistance—the volume of data generated by a single vehicle has grown exponentially.

The integration of AI into platforms like OnStar highlights the tension between convenience and privacy. During the October "GM Forward" event, the company showcased new AI-driven features, including voice-controlled vehicle functions and AI-assisted crash analysis. While these features promise to improve safety, they require access to internal camera feeds, microphone data, and real-time location.

The regulatory environment is now forcing automakers to navigate this friction. The message from regulators is clear: the convenience of "smart" features does not grant manufacturers the right to monetize the private lives of their customers. Industry analysts suggest that this settlement will likely serve as a blueprint for future litigation and regulation across the sector, forcing competitors to audit their own data-sharing practices to avoid similar multistate investigations.

Data Privacy and the Future of Automotive Revenue

For years, automakers viewed vehicle data as a "gold mine" that could be tapped to create new, high-margin revenue streams through partnerships with the insurance, marketing, and advertising sectors. The collapse of the Smart Driver model suggests that this business strategy is increasingly untenable.

As the industry pivots toward AI and advanced driver-assistance systems (ADAS), the focus is shifting from selling raw data to selling enhanced user experiences. However, the requirement for "explicit consent" presents a significant hurdle for car companies. If a significant percentage of the user base opts out of data sharing—a likely outcome given the growing awareness of privacy risks—automakers may struggle to train their AI models or provide the "personalized experiences" they have marketed to investors.

GM’s new privacy policies explicitly acknowledge that users who opt out of data sharing may find their access to certain connected features limited. This creates a "privacy tax" of sorts, where consumers must decide whether to trade their personal data for full access to the digital capabilities of their vehicles.

Conclusion: A Turning Point for Tech-Integrated Transit

The $220 million payout and the accompanying oversight measures represent more than just a legal resolution; they are a fundamental reassessment of the social contract between the consumer and the manufacturer. As vehicles continue to evolve into interconnected nodes within the Internet of Things (IoT), the regulatory framework governing them must keep pace.

The 36-state coalition has sent a strong signal to the entire automotive industry: the era of "hidden" data monetization is drawing to a close. For General Motors, the path forward requires a delicate balance of pursuing technological innovation while rebuilding consumer trust through unprecedented transparency. Whether the industry can successfully pivot to a privacy-first model remains the defining challenge of the current automotive decade. With independent audits now required, the company’s next few years will be closely monitored by both regulators and a privacy-conscious public, serving as a bellwether for how the rest of the industry handles the complex interplay of safety, innovation, and personal digital sovereignty.