Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data

Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then sold it to insurance companies. For many drivers, insurers used that data in part to set their rates.

Oregon and Washington led the coalition of 36 attorneys general that brought the case. Oregon will receive more than $10.4 million from the settlement. Going forward, GM must get drivers’ affirmative, express consent before it collects or shares their driving and location data.

“People bought a car, not a tracking device,” said Attorney General Rayfield. “GM told drivers this program would help them drive more safely and promised it wouldn’t share their data with insurers without permission. Our investigation found GM sold that data anyway, and some drivers paid for it with higher premiums. This settlement puts people back in control of their own information.”

From 2016 to 2024, GM enrolled millions of drivers in its Smart Driver program, which tracked their driving habits. GM pitched it as a way for drivers to improve their own safety and told them it would not share their data with insurers without their express consent.

Instead, the coalition found, GM sold the information to data brokers under contracts that specified the data was to be used for insurance products. Those data brokers sold it to insurance companies, who sometimes changed a driver’s premium based on how they drove. GM never told drivers their data would be used this way.

Most people who ended up in Smart Driver were enrolled at the dealership when they bought their car, through a single sign-up process that also enrolled them in GM’s OnStar services. In many cases, dealership employees allegedly accepted the terms and conditions on customers’ behalf without their consent.

At the time, GM was aggressively pushing dealerships to sign up as many OnStar customers as possible. Sales employees earned bonuses based in part on how many customers they enrolled in GM’s connected vehicle services, and dealerships were ranked by their enrollment numbers.

The OnStar app also wrongly told over 370,000 drivers they were not enrolled in Smart Driver when they were, and GM was collecting and selling their data the whole time. GM later quietly unenrolled those drivers without telling them about the mistake and left their data in the hands of data brokers and insurers.

The data was personal, identifiable, and specific. Insurers could see how many times a person drove, the start and end time of each trip, how often they braked or accelerated hard, and whether they went over the speed limit. As The New York Times(Opens in a new tab/window) reported, insurance companies used this information to change rates, sometimes raising people’s premiums. GM ended the Smart Driver program after the Times reported on these practices.

What changes now

Under the settlement, GM must:

• Get drivers’ affirmative, express consent before collecting or sharing their driving and location data.
• Limit the driving data it collects and protect consumers’ personal information through a comprehensive data privacy program.
• Undergo internal and external assessments of its data protection and privacy program.
• Put oversight and training in place at its dealerships so customers aren’t signed up for data collection without their consent.

These terms are significantly stronger than any other resolution reached with GM for this conduct.

Oregon brought this case under its Unlawful Trade Practices Act, the state’s long-standing consumer protection law. That matters, because much of GM’s conduct happened before the Oregon Consumer Privacy Act (OCPA) took effect in July 2024. The settlement shows that the UTPA remains a powerful tool for addressing privacy harms and remains a complimentary statute to more explicit consumer privacy laws such as the OCPA. For example, the OCPA bans the sale of the precise geolocation data of Oregon consumers by all covered entities, not just GM.

Attorney General Rayfield and Washington Attorney General Nick Brown co-led the case, assisted by an executive committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont. They were joined by the attorneys general of Alabama, Alaska, Arizona, the District of Columbia, Florida, Hawai’i, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, and Wisconsin.

Read the consent judgment.

Read the complaint.