Vermont AG Secures GM Data Privacy Settlement: $220 Million for Driver Tracking

• General Motors will pay $220 million to settle allegations of illegally selling private driver behavior and location data to third parties.
• The data, collected through GM's Smart Driver program, was sold to data brokers who then sold it to insurance companies, potentially affecting premiums.
• Vermont, a lead state in the investigation, will receive $4.54 million from the settlement.
• GM allegedly enrolled drivers without explicit consent, often at dealerships, and its systems mistakenly told over 370,000 drivers they weren't tracked when they were.
• The settlement requires GM to obtain affirmative express consent for data collection and disclosure, limit data collection, and implement a comprehensive data privacy program.

This settlement underscores the critical importance of obtaining affirmative express consent for collecting and sharing consumer data, particularly sensitive driving behavior and location information.

A coalition of 36 state attorneys general, spearheaded by Vermont, has reached a significant $220 million settlement with General Motors (GM) over allegations that the automotive giant unlawfully sold private driver behavior and location data. The agreement addresses claims that GM monetized sensitive consumer information, which was then passed to third-party data brokers and subsequently sold to insurance companies. Vermont Attorney General Charity Clark emphasized the importance of individual control over personal data, stating that every Vermonter should have a choice regarding data sharing. Her office played a leading role in the investigation and resolution, securing $4.54 million for the state.

The core of the issue involved GM's "Smart Driver" program, active from 2016 to 2024, which tracked the driving habits of millions of customers, including tens of thousands in Vermont. While GM promoted the program as a tool to enhance driving safety, it assured drivers that their data would not be shared with insurers without explicit consent. However, investigations revealed that GM entered into contracts with data brokers, specifically allowing the use of this information for insurance products, a purpose not disclosed to the drivers at the time of enrollment. This practice allowed insurance companies to potentially adjust premiums based on individual driving behaviors, raising significant consumer driving data privacy concerns.

The method of enrollment for the Smart Driver program was a central point of contention in the investigation. Most customers were signed up for the program at GM dealerships during the vehicle purchase process, often alongside GM’s OnStar services. Evidence suggested that dealership employees frequently accepted terms and conditions on behalf of customers without obtaining their explicit consent. This practice was reportedly fueled by GM's incentive structure, which rewarded dealerships and sales staff with bonuses for maximizing enrollments in connected vehicle services, including the Smart Driver program. Dealerships were even ranked based on their enrollment figures, creating pressure to sign up as many customers as possible, sometimes at the expense of proper OnStar data sharing consent.

Further compounding the issue, GM's internal systems failed to accurately inform drivers about their data tracking status. More than 370,000 drivers were erroneously notified by the OnStar app that they were not enrolled in Smart Driver, despite GM actively collecting and selling their data. Upon discovering this error, GM quietly unenrolled these affected drivers without disclosing the mistake, yet their previously collected data remained with the data brokers and insurance companies. The data shared was highly personal and specific, detailing driving frequency, trip durations, instances of rapid braking or acceleration, and speeding incidents, which insurance companies then utilized to potentially increase rates, as highlighted in reports by the New York Times. Following these revelations, GM ultimately discontinued the Smart Driver program.

The comprehensive settlement reached by the coalition of attorneys general imposes stringent requirements on General Motors to safeguard consumer data going forward. A primary condition mandates that GM must now secure affirmative express consent from consumers before collecting or disclosing any driving or location data. This crucial provision directly addresses the prior allegations of non-consensual data sharing. Furthermore, the agreement compels GM to limit the scope of driving data it collects from consumers and to implement robust measures for protecting personal information as part of a comprehensive GM data protection program.

The terms of this resolution are notably more robust than previous agreements GM has made regarding similar conduct. They include requirements for both internal and external assessments of GM’s data protection and privacy programs, ensuring ongoing compliance and accountability. Additionally, GM has committed to establishing oversight and training protocols within its dealerships. These measures are designed to prevent consumers from being enrolled in data collection schemes without their explicit consent, thereby reinforcing consumer driving data privacy and preventing future instances of unauthorized data sharing with entities like data brokers insurance rates. This settlement underscores the critical importance of obtaining affirmative express consent for collecting and sharing consumer data, particularly sensitive driving behavior and location information.

This settlement underscores the critical importance of obtaining affirmative express consent for collecting and sharing consumer data, particularly sensitive driving behavior and location information. Lawyers and compliance officers should review their clients' data collection practices, consent mechanisms, and third-party data sharing agreements to ensure compliance with evolving data privacy expectations and avoid similar enforcement actions from state attorneys general.

Source: Original reporting via Attorney General Charity Clark's office.