Two hundred twenty million dollars sounds like a punishment. For a company the size of General Motors, it is closer to a cost of doing business. The more useful number is 36, the count of states whose attorneys general went after GM for selling drivers’ location and driving behavior data to brokers who passed it to insurers.
According to TechCrunch, the settlement requires GM to get express consent before it collects or shares driving and location data. That matches earlier deals with California and the FTC. The new piece is a requirement that a third party assess whether GM actually follows its privacy program. Independent checking matters, because a company’s promise to behave is only worth something if someone can verify it.
The case traces back to a New York Times investigation more than two years ago. It showed that GM and OnStar collected precise geolocation and driving behavior through Smart Driver, a free feature in its connected car apps that rated how you drove and whether you wore a seat belt. That data reached LexisNexis and Verisk, and then insurers, which could raise customers’ rates. So a feature pitched as driving help became a pipeline to your premiums.
GM says it ended Smart Driver in 2024 and that the settlement reinforces steps it has already taken. Shutting the program down did not end the legal exposure, though. In January the FTC finalized an order banning GM and OnStar from sharing certain consumer data. GM now says it will not sell vehicle data linked to an individual, their car’s location, or how they drive. But read the fine print: it may still disclose anonymized data with certain partners. Anonymized location data has a poor track record, since movement patterns are easy to re-identify.
This matters beyond one automaker. Cars are turning into rolling sensor packages, and carmakers are betting heavily on software that connects to your calendar, messages and email. GM is adding a personal AI assistant to OnStar, with cameras offering live views and crash recordings, plus voice control of vehicle functions. More sensors mean more data, and more data means more temptation.
GM stresses privacy for the new assistant. Customers decide what is shared, recordings are encrypted and time limited, and GM says neither it nor OnStar can access Connected Camera recordings. That is better than silence. But GM also admits that customers who decline to share data will likely lose access to some features. That is the pressure point: consent is hollow when refusing means a worse product.
The settlement shows regulators will act, slowly and after a journalist does the digging. Drivers should not count on that timeline. Check the Privacy Center, turn off what you can, and assume any data a car collects is something a company wants to monetize.