General Motors agrees to $220 million payout in Oregon-led data privacy case

(KTVZ) -- General Motors will pay $220 million to settle allegations from a 36-state coalition that the automaker sold drivers' private driving and location data to third-party brokers without customer permission.

Oregon, which co-led the multi-state coalition alongside Washington, will receive more than $10.4 million from the settlement.

The settlement addresses GM's Smart Driver program, which tracked driving habits for millions of vehicle owners between 2016 and 2024. State investigators found that GM pitched the program as a safety tool and promised not to share data with insurance companies without express consent, but sold the information to data brokers who then provided it to insurers to adjust rates.

Most customers were enrolled in Smart Driver at dealerships through a unified sign-up process for GM's OnStar service. To meet corporate enrollment targets that tied sales bonuses to connected vehicle sign-ups, dealership employees frequently accepted terms and conditions on behalf of buyers without their knowledge.

In addition, GM's OnStar mobile application incorrectly informed more than 370,000 drivers that they were not enrolled in Smart Driver while continuing to collect and sell their data. GM later quietly unenrolled those drivers without notifying them of the error, leaving the previously collected information with data brokers and insurance providers.

The collected data was personal and specific, detailing trip start and end times, trip frequency, hard braking, rapid acceleration and speeding. GM ended the Smart Driver program after public reporting by The New York Times detailed how insurers used the information to adjust rates.

Oregon Attorney General Dan Rayfield co-led the multi-state investigation alongside Washington Attorney General Nick Brown. “People bought a car, not a tracking device,” Rayfield said. “GM told drivers this program would help them drive more safely and promised it wouldn't share their data with insurers without permission. Our investigation found GM sold that data anyway and some drivers paid for it with higher premiums. This settlement puts people back in control of their own information.”

Oregon filed its enforcement action under the state Unlawful Trade Practices Act because much of GM's conduct occurred before the Oregon Consumer Privacy Act took effect in July 2024. The newer privacy statute restricts all covered entities from selling precise geolocation data belonging to state residents.

The investigation was supported by an executive committee consisting of attorneys general from Colorado, Conn., Del., Ill., Ky., Md., Minn., N.J., Utah and Vermont, along with 24 other states and the District of Columbia.

Under the settlement terms, GM must obtain affirmative, express consent before collecting or sharing driver data, limit the driving information it gathers, establish a comprehensive data privacy program and undergo both internal and external privacy assessments. The automaker is also required to implement dealership oversight and training to prevent unauthorized customer sign-ups.