General Motors has agreed to pay $220 million to 35 states and the District of Columbia to settle a larger privacy lawsuit over the company’s sale of driver data from its Smart Driver program, which dealers offered to drivers from 2016 to 2024.
In 2024, the New York Times published a damning investigation into the program, revealing that in some cases data about drivers’ habits could be used by insurance companies to set rates. Some drivers saw significant premium increases after GM sold their driving history, and one owner was told a 22% premium increase was obtained from driving information provided by a data broker, according to a statement from the New York Attorney General’s Office.
The data collection was described as “spying,” and GM quickly ended the program that year. In 2025, GM settled with the Federal Trade Commission over Smart Driver and OnStar location data, a five-year ban on selling driver data.
Attorneys general in many of the states involved in the $220 million settlement have released announcements about it, including Anthony G. Brown of Maryland.
“Without asking permission, General Motors sold its customers driving and location data that, in some cases, was used by insurance companies to set driver rates,” Brown said in a release. “Because of our settlement, GM can no longer prioritize profits over the privacy of Marylanders.”
The settlement requires GM to obtain affirmative express consent from consumers before collecting or disclosing consumer driving and location data.
In an email to CNET, a GM spokesperson shared a statement, saying the company discontinued its Smart Driver product in 2024 and that it has strengthened its privacy practices since then.
“Safe, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it is protected, and customers’ choices about what they share,” the spokesperson said.
The company also told CNET that it has simplified and updated its US privacy policy, created a privacy center for consumers and “improved internal controls for connected vehicle data.”
Not at the end of the road for car privacy concerns
Cars have evolved into computers on wheels in recent decades, collecting vast amounts of data about drivers, including contacts and song lists, location data and diagnostic information. For GM, the issue was less about gathering data than about breaking its promise to customers that it would not sell them.
There may be more action on illegal or unethical data collection practices in the automotive industry.
“GM was the biggest case and, in some ways, presented the most egregious set of facts. But collecting and selling driving data is an industry norm, not an aberration,” said Peter Cassat, technology partner at CM Law and a former general counsel for Cox Automotive and New Country Motor Group.
“The difference now is that regulators have a template, and every state attorney general has seen a $220 million settlement, so I think we can expect more enforcement actions and settlements,” said Cassat.
The settlement and the orders in place that GM must abide by are a good start to promoting best practices for privacy in the auto industry, Cassat said.
“Vehicle vendors should ask for driver consent feature of feature in plain English,” he said, not simply asking buyers to check a box.
Protect your privacy behind the wheel
In addition to all the documents you sign when you buy, lease or rent a car, everyday vehicle use can present some data hygiene problems. Privacy issues can increase depending on the level of access you give your smartphone and how you use the car’s location or connectivity features.
In addition to the touchscreen on your dashboard, modern vehicles run background systems that transmit data directly to the manufacturer, and drivers have little to no control over what is collected or who buys it.
Clyde Williamson, a senior security architect at the AI and data security company Protegrity, talked about auto privacy, saying that protecting your data can be “really complicated.”
“Modern cars can carry many of the same privacy risks as our smartphones, potentially without the same level of attention to security from the manufacturer,” Williamson said.
Williamson said that while people have started to raise privacy concerns about other smart devices like TVs, cars don’t get the same scrutiny. And there aren’t many ways you can go about protecting your data in cars without losing key conveniences.
“Unfortunately, there is not much consumers can do,” he said. “Opt out where possible and do not consent to unnecessary data sharing. Check your own Customer Disclosure Report to see if driving data appears. And if your car has a modem that can be turned off, consider disabling it.”