GM Pays $220 M to Settle Lawsuit Over Unauthorized Sale of Driver Location and Behavior Data
What Happened — General Motors (GM) agreed to a $220 million settlement with a coalition of 36 state attorneys general after the states alleged that GM unlawfully collected and sold consumers’ vehicle location and driving‑behavior data to third‑party data brokers. The data were then passed on to insurers, influencing insurance pricing. From 2016 through 2024 GM enrolled millions of drivers in a “Smart Driver” program, promising that data would not be shared without explicit consent. Internal incentives encouraged dealership staff to enroll customers, and GM failed to obtain the required affirmative consent before the data transfers. The settlement requires GM to obtain clear, express consent from customers before any future collection or sharing of such data and to implement privacy‑by‑design safeguards.
Why It Matters for Trust & Control Assurance — The case highlights the need for robust consent‑management controls that can be demonstrated to regulators and auditors.
Who Is Affected — Automotive manufacturers, connected‑vehicle service providers, and any organization that collects location or behavior data from consumers.
Recommended Actions
- Review and redesign data‑collection flows to include an explicit, opt‑in consent step before any personal data leaves your environment.
- Conduct a privacy impact assessment (PIA) and map consent‑related controls to your audit framework of record.
Technical Notes — The violation stemmed from internal program design and dealer‑incentive structures rather than a technical exploit. No CVEs or malware were involved. Source: The Record