Attorney General Kathy Jennings has announced that General Motors will pay $220 million to settle allegations that it illegally sold consumers’ private driver behavior and location data. The data – collected by GM’s OnStar Smart Driver to data brokers who then sold the data to insurance companies – was used by insurance companies in part to set insurance rates for many customers.
AG Jennings helped lead a coalition of 36 attorneys general in the case against GM. Delaware will receive $4,726,779 through the settlement, which also includes broad injunctive relief including an explicit requirement that GM obtain express consent from consumers before collecting or disclosing driving and location data.
“Delawareans deserve to be able to trust that companies won’t illegally share their private data,” said Attorney General Kathy Jennings. “Today’s settlement ensures that GM won’t deceive consumers about its data practices in the future. It also highlights why this year’s Delaware Personal Data Privacy Act amendments are so important: they help us stop businesses from selling sensitive data, and they’re going to be a crucial tool for us as we continue vigorously protecting Delawareans’ data privacy.”
From 2016 to 2024, GM enrolled millions of car buyers in its Smart Driver program, which tracked owners’ driving habits and location history. GM pitched this tool as a way for drivers to improve driving safety and told drivers that they would not share their data with insurers without express consent.
However, the states’ investigation found that GM sold this driver and location information to data brokers under contracts that specified the data was to be used for insurance products. The data brokers sold the data to insurance companies, who could then set premiums based on car owners’ driving habits.
Most customers signed up for Smart Driver at a GM dealership when they purchased their car. GM used a single sign-up process for drivers to enroll in Smart Driver along with other OnStar services. In many cases, dealership employees allegedly accepted terms and conditions on behalf of customers without their consent. At the time, GM offered substantial incentives to dealerships to enroll as many customers for OnStar as possible. Sales employees received bonuses based in part on how many customers they signed up and dealerships were ranked based on their enrollment numbers.
GM’s systems also failed to notify drivers about whether their data was being tracked. The OnStar app mistakenly told over 370,000 drivers that they were not enrolled in Smart Driver, when they actually were enrolled; GM subsequently collected and sold their data. GM later quietly unenrolled these drivers without informing them about the mistake and left their data with the data brokers and insurance companies.
The data GM sold was personal, identifiable, and specific. Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit. Insurance companies could then use this information to change rates, including to increase drivers’ premiums. GM discontinued the Smart Driver program in June 2024.
The settlement requires that GM establish a comprehensive data privacy program and limit the driving data it collects. The terms secured by the coalition are significantly stronger than any other resolution reached with GM for this conduct and mandates both board-level oversight and external assessments of GM’s data protection and privacy program. GM also agreed to oversight and training requirements at their dealerships to protect consumers against being enrolled in data collection schemes without their consent.
Delawareans can learn more about data privacy rights or submit a complaint at privacy.delaware.gov.
As a member of the executive committee, Delaware worked together with Washington, Oregon, Colorado, Connecticut, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont to reach this settlement in which a total of 36 states joined. Read the settlement here.