AGs reach $220 million settlement with General Motors regarding consumer data-sharing

HARRISBURG — Attorney General Dave Sunday joined a coalition of 36 attorneys general in reaching a $220 million settlement with General Motors regarding consumer data-sharing.

According to a news release, the settlement resolves allegations that General Motors illegally sold consumers' private driver behavior data and location information to third parties, including data brokers who then sold the data to insurance companies. For many consumers, this data was used by insurance companies in part to set insurance rates.

Pennsylvania is expected to receive $8.67 million through the settlement.

Additionally, the settlement requires General Motors to obtain affirmative express consent from consumers before collecting or disclosing consumer driving and location data.

"General Motors promised consumers their personal driving data would not be shared, then turned around and essentially exploited that data by selling it to insurance providers," Sunday said in the release.

From 2016 to 2024, GM enrolled millions of drivers in their Smart Driver program, which tracked their driving habits. GM pitched this tool as a way for drivers to improve their own driving safety and told drivers that they would not share their data with insurers without express consent.

However, the coalition found that GM sold this information to data brokers under contracts that specified the data was to be used for insurance products. The data brokers sold the data to insurance companies, who could then change the driver's premium based on their driving habits. GM did not disclose to drivers that their data would be sold for this purpose.

The data GM sold was personal, identifiable, and specific. Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit. As documented in the New York Times, insurance companies then used this information to change rates, sometimes increasing their premiums. After the Times reported on these practices, GM discontinued the Smart Driver program.

The settlement also requires GM to limit the driving data it collects from consumers and protect their personal information going forward as part of a comprehensive data privacy program. The terms secured by the coalition are significantly stronger than any other resolution reached with GM for this conduct including by mandating internal and external data protection and privacy program assessments. GM also agreed to oversight and training requirements at their dealerships to protect consumers against being enrolled in data collection schemes without their consent.

The case was co-led by Washington and Oregon, assisted by the Executive Committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont, and joined by the attorneys general of Alabama, Alaska, Arizona, the District Of Columbia, Florida, Hawai'i, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Virginia and Wisconsin.

Distributed by Newsbank, inc.