GM: $220M Driver Data Privacy Settlement Ends Smart Driver Program Lawsuit

• General Motors will pay $220 million to settle a multistate lawsuit regarding the sale of private driving data.
• The lawsuit alleged GM sold data from its Smart Driver program, which tracked driver behavior, to data brokers for insurance purposes.
• A coalition of 36 attorneys general claimed GM failed to notify drivers about data tracking and that some drivers faced higher insurance premiums as a result.
• The settlement mandates GM obtain affirmative express consent before collecting or disclosing driving and location data.
• GM discontinued its Smart Driver program in 2024 and states it does not sell vehicle information linked to individuals.

Under the terms of the GM $220M driver data privacy settlement, General Motors is now mandated to secure affirmative express consent from consumers before collecting or disclosing their driving and location data.

General Motors has agreed to a $220 million settlement to resolve a multistate lawsuit alleging the automaker sold private driving behavior and location data to third-party data brokers. This significant GM $220M driver data privacy settlement addresses claims stemming from GM's now-discontinued Smart Driver program, which was designed to track driver behavior. The legal action was spearheaded by a coalition of 36 attorneys general, led by Oregon and Washington, who initiated an investigation into the company's data practices.

The Smart Driver program, active between 2016 and 2024, saw millions of drivers enroll, with a substantial portion signing up at GM dealerships during vehicle purchases. Enrollment was often linked with OnStar, GM’s subscription-based security and safety service. The attorneys general contended that GM actively encouraged dealerships to maximize sign-ups for OnStar and other vehicle services, offering sales employees bonuses tied to enrollment figures and ranking dealerships based on their success in these programs.

A central accusation in the GM Smart Driver program lawsuit was that GM's internal systems failed to adequately inform drivers that their data was being tracked. The collected information, described as personal, identifiable, and specific, was subsequently sold to data brokers under contracts that explicitly permitted its use for insurance products. Oregon Attorney General Dan Rayfield highlighted that GM had assured drivers the program would promote safer driving and that their data would not be shared with insurers without explicit permission. However, the investigation revealed that GM proceeded to sell this data, leading some drivers to face increased insurance premiums.

Further compounding the issue, the OnStar app incorrectly informed approximately 370,000 drivers that they were not enrolled in the Smart Driver program, despite their data actively being collected and sold by GM. The attorneys general reported that GM later quietly unenrolled these affected drivers without notifying them of the error, yet their previously collected data remained with insurance companies and data brokers. This data provided detailed insights, including trip start times, driving frequency, braking habits, and speeding instances, which were sometimes utilized to adjust insurance rates. This situation underscores the complexities of vehicle data privacy compliance.

Under the terms of the GM $220M driver data privacy settlement, General Motors is now mandated to secure affirmative express consent from consumers before collecting or disclosing their driving and location data. Furthermore, the automaker must restrict data collection to only what is relevant and necessary for the specific, stated purpose for which it was gathered. This aspect of the OnStar data sharing settlement sets a clear precedent for future data handling.

A GM spokesperson confirmed that the Smart Driver program was discontinued in 2024, asserting that the settlement reinforces the privacy measures already implemented by the automaker. The company expressed its commitment to transparency regarding the use and protection of connected vehicle data, emphasizing customer choice in data sharing. While GM maintains that it does not sell vehicle information directly linked to an individual, it acknowledges that it may disclose data not associated with specific drivers, a distinction that remains crucial in the ongoing conversation around driver behavior data sale lawsuit and data privacy.

This settlement highlights the critical need for automotive companies, and any entity collecting sensitive consumer data, to implement robust, explicit, and affirmative consent mechanisms for data collection and sharing. Legal and compliance teams should review current data privacy policies, particularly concerning connected vehicle data and third-party sharing, to mitigate risks of regulatory enforcement and class-action litigation related to undisclosed data monetization or impact on consumer services like insurance.

Source: Original reporting via CN.