Location data a big part of the privacy violations…fines reach $232 million
General Motors GM 0.00%↑ has agreed to pay $220 million to settle allegations from a bipartisan coalition of state attorneys general that it collected and sold detailed driving and location data from millions of customers without adequate disclosure or consent.
The multistate settlement, announced late last week and co-led by Washington and Oregon, resolves claims involving GM’s OnStar Smart Driver program, which operated from 2016 until the company discontinued it in 2024. Combined with an earlier $12.75 million California agreement, the total reaches $232.75 million. Attorneys general said GM tracked high-resolution location points and driving behavior such as harsh braking, rapid acceleration and speed, then sold the information to data brokers that supplied it to insurers, which sometimes used it to set or raise premiums.
“Washingtonians’ data is personal and valuable, which is why they should always have control over how it’s used,” Washington Attorney General Nick Brown said. “We’re proud to lead this bipartisan agreement holding GM accountable for misusing drivers’ data.”
State officials alleged many drivers were enrolled at dealerships through a single sign-up process that also activated OnStar services, sometimes without clear customer knowledge. Investigators also said the OnStar app incorrectly told more than 370,000 drivers they were not enrolled when data collection continued. Under the settlement, GM must obtain affirmative, express consent before activating connected-vehicle tracking, limit data collection, strengthen privacy protections and improve oversight of dealership enrollment practices.
GM said the agreement addresses a product it ended in 2024 and reinforces steps it has already taken to strengthen privacy practices. The settlement resolves the allegations without a court finding on the claims.
Days after the announcement, Ford F 0.00%↑ issued a “Privacy Promise” stating it will never sell data about how customers drive their vehicles to data brokers. Ford’s chief privacy officer, Kristin Jones, said the company aims to protect personal information, explain data use in clear terms and give customers control over sharing preferences.
