General Motors has agreed to pay $220 million to settle a multistate lawsuit alleging the automaker sold drivers' personal data to insurance companies without their consent, according to a coalition of state attorneys general who announced the deal on Thursday.
The settlement, involving 35 states and Washington, D.C., was led by Oregon Attorney General Dan Rayfield and Washington Attorney General Nick Brown, both Democrats, and includes Republican attorneys general from states like Ohio and others. GM did not admit liability as part of the agreement.
The dispute centers on GM's Smart Driver program, which allowed customers to enroll at dealerships to have their driving habits monitored for safety feedback. The states alleged that GM then sold that data—including speeding, hard braking, and trip times—to data brokers, who in turn sold it to insurance companies, often without the drivers' knowledge.
Washington AG Nick Brown said in a statement that the information was highly personal and specific. “The data GM sold was personal, identifiable, and specific. Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit,” Brown said.
Brown also noted that when drivers tried to check their enrollment status, GM's OnStar app incorrectly told more than 370,000 people they were not enrolled when they actually were.
The practice came to light after a March 2024 New York Times report revealed that some drivers saw their insurance premiums rise without any accidents, and others struggled to get coverage at all, because of the data GM had provided. GM has since discontinued the Smart Driver program, which had been active since 2016.
Several state attorneys general celebrated the settlement on social media, including Ohio's Andy Wilson (R), Virginia's Jay Jones (D), Colorado's Phil Weiser (D), and New York's Letitia James (D). Jones wrote on X: “My office is proud to defend Virginians' privacy rights.”
The settlement follows action by the Federal Trade Commission in January 2025, which barred GM from disclosing certain driver data to consumer reporting agencies for five years and required the company to give consumers a way to request deletion of their data.
Texas, which filed its own lawsuit against GM in 2024 over the program, is not part of this settlement, and that litigation remains ongoing. The case underscores growing bipartisan concern over data privacy in the auto industry, as states also grapple with broader data protection issues.
