General Motors agrees to pay $220 million to settle multi-state data privacy lawsuit

General Motors agreed to pay $220 million under a settlement addressing allegations involving information about drivers’ behavior and locations.

Oregon and Washington led a coalition of 36 attorneys general in the case. The allegations include claims that data brokers sold General Motors driver information to insurance companies.

Millions of motorists participated in General Motors’ Smart Driver program from 2016 through 2024. The information at issue included when trips occurred, how frequently people drove, instances of abrupt braking, rapid acceleration and speeding.

The settlement changes how General Motors may handle driving and location information. Before collecting or sharing that data, the company must secure affirmative express permission from consumers.

The agreement also calls for assessments of General Motors’ privacy program, restrictions on the amount of driving information collected, and oversight and training for dealerships. Those provisions address both the company’s data practices and the way participating dealerships handle related requirements.

Oregon is expected to receive more than $10.4 million from the settlement. Pennsylvania is expected to receive $8.67 million.

The settlement combines a financial payment with requirements covering consent, data collection and privacy oversight. The case involves allegations about information generated through a connected driving program and later transferred through data brokers.