GM Will Pay $220 Million Over Driver Data Allegedly Used to Set Insurance Rates

A connected car can turn braking, acceleration, speed, trip timing and location into a detailed driving profile. In General Motors’ Smart Driver program, state officials alleged that this information moved from vehicles to data brokers and then to insurance companies, where it was used in part to set some customers’ rates. GM will pay $220 million to resolve claims brought by 35 states and the District of Columbia.

The settlement, announced November 1, covers a program that enrolled millions of drivers from 2016 until GM discontinued it in 2024. Smart Driver was presented as a way to help motorists improve their personal driving safety. The participating attorneys general alleged that GM sold identifiable behavior and location data without the permission it had promised to obtain. According to Washington’s attorney general, insurers could use the resulting profiles to change premiums.

A safety feature became part of an insurance data chain

The central systems issue is not vehicle sensing by itself. Modern connected services necessarily process data to deliver navigation, emergency assistance, maintenance alerts and driver feedback. The accountability problem emerges when information collected for one stated function passes into a second commercial system with a materially different consequence.

In this case, the alleged chain had three stages: Smart Driver collected information from the vehicle; GM supplied it to brokers under contracts specifying use for insurance products; and brokers sold it to insurers. State officials said the records included trip frequency, start and end times, rapid braking or acceleration and speeding. Each data point may look limited in isolation, but together they can produce a persistent, identifiable risk profile.

That transfer changes the practical meaning of consent. A driver may accept monitoring to receive safety feedback without reasonably expecting the same information to influence the price or availability of insurance. The financial consequence also may arrive outside the vehicle interface, potentially leaving the motorist to discover the data flow only after an insurance decision.

Enrollment design was part of the failure

The allegations also show why consent cannot be treated as a one-time legal checkbox. Most Smart Driver enrollment occurred at dealerships alongside OnStar activation. State investigators alleged that employees sometimes accepted terms for customers without their consent while GM offered incentives tied to connected-service enrollment.

That is a human-factors and systems-integration problem. A dealership employee, vehicle owner, regular driver, app account and insurance customer may all be different people. A defensible connected-car system must identify who is authorizing collection, explain which data categories are involved, specify their intended recipients and provide a reliable indication that monitoring is active.

The status display must also agree with the back-end system. Washington officials said the OnStar app incorrectly told more than 370,000 drivers that they were not enrolled even though GM was collecting and selling their data. Those drivers were later removed from the program, but officials said their information remained with brokers and insurers. A privacy control that displays the wrong state cannot give users meaningful control, regardless of what the underlying terms say.

The settlement pushes consent into system architecture

Under the multistate agreement, GM must obtain affirmative, express consent before collecting or disclosing driving and location data. It must also limit collection, maintain a comprehensive privacy program and submit to internal and external assessments. Dealership oversight and training are included, addressing the point where many customers allegedly entered the program.

Those requirements move privacy beyond policy language and into product engineering. Consent status must propagate correctly across the vehicle, mobile application, dealership tools, cloud services and downstream interfaces. Data inventories must distinguish information needed for emergency response from optional analytics or commercial disclosure. Revocation must stop future collection and sharing rather than merely change a screen setting.

A separate Federal Trade Commission action in 2025 sought similar controls, including affirmative consent, access and deletion mechanisms, location-data opt-outs and a five-year prohibition on disclosures to consumer reporting agencies. The agency described it as its first connected-vehicle data action, indicating that vehicle telemetry is now being treated as a consumer-protection system rather than only an automotive feature.

Telematics can still provide useful safety feedback and support insurance programs that drivers knowingly choose. The tradeoff becomes unacceptable when enrollment is unclear, the displayed status is inaccurate or data collected for coaching enters insurance pricing without informed authorization. GM ended Smart Driver in 2024, but the settlement’s lasting engineering consequence is broader: connected-car privacy controls now have to work with the same state accuracy, traceability and verification expected of other consequential vehicle systems.

By Thomas Caldwell — AMI’s senior editor for mechanical and mobility engineering, covering vehicle electronics, systems integration, electrification, chassis systems, propulsion, and safety policy.