Ohio Attorney General Andy Wilson joined a coalition of 36 attorneys general in announcing an agreement requiring General Motors to pay $220 million over allegations that it illegally sold consumers’ driving behavior and location data to third parties.
Ohio will receive $8,076,105 from the settlement, which requires GM to obtain express consent from consumers before collecting or disclosing driving and location data.
“GM broke consumers’ trust by selling such data without their knowledge and consent,” Wilson said. “Ohioans should not have to worry that the information collected by their own vehicles will be used against them. Companies must be held accountable when they put profits ahead of consumers’ privacy.”
From 2016 to 2024, GM enrolled millions of drivers in its Smart Driver program, which tracks driving habits. The company pitched the tool as a way for drivers to improve driving safety and told them they wouldn’t share their data with insurers without their consent.
But GM sold the data to insurance brokers, who then passed it to insurance companies to adjust premiums based on driving habits. GM did not disclose the data sale to consumers.
Most who enrolled in Smart Driver did so at the GM dealership where they bought their car.
GM used a single sign-up process to enroll drivers in both Smart Driver and its OnStar services.
At the time, GM was heavily incentivizing dealerships to sign up as many customers for OnStar as possible.
Sales employees received bonuses based partly on the number of customers enrolled in GM’s connected vehicle services, with dealerships then ranked based on the enrollment numbers.
GM’s own systems misled drivers about the data tracking.
The OnStar app mistakenly told 380,000 drivers that they were not enrolled in Smart Driver when they were, and GM was collecting and selling their data.
GM later quietly unenrolled those drivers without telling them about the mistake and left their data with the brokers and insurance companies.
The settlement requires GM to limit the driving data it collects from consumers and protect their personal information going forward as part of a comprehensive data-privacy program.
The terms secured by the coalition include mandating internal and external data protection and privacy program assessments.
GM also agreed to oversight and training requirements at its dealerships to protect consumers against data collection schemes without their consent.
Ohio was joined by the attorneys general of Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Hawai’i, Idaho, Illinois, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington and Wisconsin.
