GM Allegedly Spied On Drivers And Sold Their Data, Now It’s Paying A $220M Settlement

If you had a suspicion your modern car is spying on you, you’re probably right. Vehicles these days are connected to the Internet of Things, able to feed data back to the cloud in real time. Once it’s there, what happens next may not be something you explicitly agreed to. Now the tide is starting to shift. After allegedly selling data on drivers to third parties without clear consent, General Motors has agreed to a $220 million settlement and terms that aim to limit data collection and establish new, more ethical practices.

So how did we get here? Back in 2024, the New York Times broke the story that GM was allegedly sharing vehicle data with data broker LexisNexis. Data that reportedly included trip distance, instances of speeding, instances of hard braking, and instances of sharp acceleration. Insurance companies could then use a driver’s LexisNexis risk profile to raise rates, and most drivers were completely unaware of this arrangement.

One of the big alleged problems here is that active consent to data-sharing was virtually nonexistent. According to a New York Times writer who owned a GM vehicle and signed up for OnStar’s Smart Driver event monitoring function, “there was no warning or prominent disclosure that any third party would get access to my driving data.” What’s more, the paper reports that “some drivers with vehicles made by G.M. say they were tracked even when they did not turn on the feature — called OnStar Smart Driver — and that their insurance rates went up as a result.”

While it was possible to unenroll from the Smart Driver program without spending hours on the phone, it was effectively a seven-step process for a driver to remove themselves from a program they might not have known they were already in. Perhaps unsurprisingly, this attracted a great deal of scrutiny, to the point where a coalition of 36 Attorneys General brought forward a case.

Oregon was one of the co-leaders behind the coalition, and the complaint in that state was brought forward under alleged “violations of the Oregon Unlawful Trade Practices Act.” As per a statement issued by the Oregon AG office:

Most people who ended up in Smart Driver were enrolled at the dealership when they bought their car, through a single sign-up process that also enrolled them in GM’s OnStar services. In many cases, dealership employees allegedly accepted the terms and conditions on customers’ behalf without their consent.

At the time, GM was aggressively pushing dealerships to sign up as many OnStar customers as possible. Sales employees earned bonuses based in part on how many customers they enrolled in GM’s connected vehicle services, and dealerships were ranked by their enrollment numbers.

The OnStar app also wrongly told over 370,000 drivers they were not enrolled in Smart Driver when they were, and GM was collecting and selling their data the whole time. GM later quietly unenrolled those drivers without telling them about the mistake and left their data in the hands of data brokers and insurers.

That last part seems like an especially egregious ethical violation, as it reads exactly like spying. Collecting data on those who are unaware, denying the collection of data, then quietly stopping monitoring while maintaining said data. Especially since GM’s Smart Driver metrics are likely poor indicators of how safe a driver actually is. As my colleague Jason Torchinsky previously wrote:

Take the “hard braking” metric, for example. It’s treated as a negative, with scores lowering if you have a lot of hard braking incidents. But there are absolutely times while driving where you want to brake, and brake hard. If a kid or deer or a kid on a deer or dog or tortoise or whatever bolts out unexpectedly in front of you, a safe driver will apply their brakes, hard. Soft, gradual braking is not safe in such a situation, but the data gathering does not appear to take the overall situation into account.

As for the settlement itself, all funds go to the states registered as plaintiffs, but the terms of the settlement also have further stipulations for GM. The company must, within the next 180 days, put in place a new privacy program that shall remain in effect into 2046. The company must also appoint a Chief Privacy Officer, issue a clear privacy notice to drivers, and must obtain affirmative consent before collecting any driver’s protected driver data in a method that isn’t rolling it into the terms of service. Oh, and GM must request the deletion of driver data shared with third parties prior to Jan. 16, 2025, allow drivers to disable location services, and make drivers aware that they can disable location services.

It’s worth noting—even if just to keep our lawyers happy—that legally, a settlement isn’t an admission of guilt. Cases can be won, cases can be lost, and cases can be settled. However, a settlement isn’t the same as having no guilt found. As such, these claims against GM cannot legally be confirmed or refuted, regardless of evidence presented.

Still, it’s safe to say there’s enough here that a case was brought forward, mostly because that’s what happened. So what’s next? Well, under the terms of the settlement, all parties waive their right to appeal, so don’t expect much further courtroom action by individual states. GM’s Smart Driver program has since been discontinued, and further individual recoup over raised insurance premiums now seems to be left up to well, individuals. On the other hand, GM likely isn’t the only automaker selling drivers’ data. These days, all cars are connected, and the level of data collection most drivers unwittingly agree to through end user licence agreements they’ll never look at is astonishing. A 2023 Mozilla Foundation report found that Nissan’s agreement stated it could collect “a wide range of information, including sexual activity, health diagnosis data, and genetic data” and share driver data with third parties including brokers.

In short, this settlement means GM will need to make some proper changes, and it means other automakers should be looking at their data policies and re-working them as necessary for compliance. If Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, Florida, Hawaii, Idaho, Illinois, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, Wisconsin, and the District of Columbia can all team up to take one automaker to court over deceptive data practices, there’s probably more where this came from.

Top graphic images: Chevrolet; DepositPhotos.com