New Jersey to receive $8.9 million in settlement over GM sale of drivers’ private data

The automaker allegedly sold information about driver speeds, braking habits, and locations to data brokers, allowing insurers to raise rates without drivers’ knowledge.

General Motors secretly collected and sold detailed information about millions of drivers’ habits to data brokers, who passed it to insurance companies that then used it to set rates, according to a multistate investigation that resulted in a $220 million settlement announced Thursday.

New Jersey will receive $8.9 million from the settlement, which resolves allegations that the automaker violated consumer privacy laws by selling drivers’ personal information without their knowledge or consent.

The information included how often people drove, when and where they traveled, whether they wore seat belts, how fast they drove, and how frequently they braked or accelerated suddenly.

Insurance companies used the data to assess driver risk and, in some cases, raised premiums, according to state officials.

From 2016 to 2024, GM enrolled millions of customers in its Smart Driver program, which it promoted as a tool to help people improve their driving habits. The company told drivers it would not share their information with insurers without their express consent.

But investigators found that GM sold the data to brokers under contracts that specifically allowed its use for insurance products.

Many customers were enrolled at dealerships when purchasing vehicles, sometimes without their knowledge. According to investigators, dealership employees accepted terms and conditions on customers’ behalf without permission. GM offered financial incentives to dealerships and employees to increase enrollment in its connected vehicle services.

In one case, the company’s OnStar app incorrectly told 370,000 drivers they were not enrolled in Smart Driver, even though GM was collecting and selling their data. The company later removed those drivers from the program without notifying them of the error or retrieving their information from data brokers and insurers.

The practices were exposed in a 2024 investigation by The New York Times, after which GM discontinued Smart Driver.

“New Jersey drivers should not have to worry about their insurance rates going up as a result of their personal information being secretly sold to data brokers by the car company and its partners,” Attorney General Jennifer Davenport said in a statement.

Under the settlement with 36 attorneys general, GM must obtain consumers’ explicit consent before collecting or sharing their driving and location data. The company must also limit data collection, undergo privacy assessments, and strengthen dealership oversight to prevent unauthorized enrollment. The agreement includes internal and external monitoring of GM’s data privacy practices.

According to GM, the company does not sell vehicle information that can be linked to an individual, their vehicle location, or how they drive. The company “may disclose de-identified data (not associated with specific drivers or vehicles) with select partners, for example to enhance city infrastructure and improve road safety for pedestrians, cyclists, and drivers.”

The company has taken a number of steps relating to consumer privacy, including simplifying and updating GM’s U.S. privacy statement, creating a consumer-facing privacy center, enabling customers to exercise privacy rights in all 50 states, and enhancing internal controls for connected vehicle data. 

“This agreement addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” a GM spokesperson said in an email. “Safer, more helpful, and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share.”