Your car could be sharing more than your location and driving habits. That information could also affect how much you pay for insurance.
General Motors (GM) has agreed to pay $220 million to settle claims brought by 36 US states that it collected and shared drivers’ personal information without proper consent. The case centers on Smart Driver, a feature that monitored driving behavior and allegedly allowed sensitive information to be shared with third-party data brokers.
The settlement raises questions about how automakers handle customer information and whether drivers truly understand where their data goes after they enable connected-car features.
How GM’s driving data allegedly reached insurance companies
The controversy dates back to March 2024, when a New York Times investigation revealed that General Motors had shared customers’ driving information with third-party data brokers, including LexisNexis Risk Solutions and Verisk.
The information came from Smart Driver, a connected-car feature designed to help vehicle owners monitor their driving habits. The program collected information about behaviors such as speeding, hard braking, and rapid acceleration.
However, GM allegedly sold the information to data brokers under contracts specifying that it would be used for insurance products. Those brokers then sold the data to insurance companies, which used it to assess driving risks and, in some cases, increase customers’ premiums.
The central issue was consent. According to the attorneys general, GM told customers that their driving information would not be shared with insurers without their express permission. However, investigators found that GM sold the information to data brokers without disclosing that it would ultimately be used for insurance products.
The investigation also uncovered problems with how customers were enrolled. According to the Washington attorney general’s office, dealership employees allegedly accepted enrollment terms on customers’ behalf without their permission.
GM’s OnStar app also mistakenly told more than 370,000 drivers that they were not enrolled in Smart Driver, even though the company was collecting and selling their information. GM later removed those drivers from the program without notifying them of the error, but their previously collected information remained with data brokers and insurance companies.
GM discontinued Smart Driver in 2024, but the legal scrutiny continued. Under the October 2026 settlement, the automaker agreed to pay $220 million and obtain customers’ affirmative, express consent before collecting or sharing their driving and location information. The settlement also requires GM to limit data collection, undergo privacy assessments, and strengthen oversight of dealerships to prevent unauthorized enrollment.
GM did not admit liability as part of the settlement.
Why the incident matters for enterprises
Enterprises usually collect customer data for different purposes, making GM’s case relevant, even if it’s in a different industry.
These enterprises must ensure the data they collect isn’t repurposed beyond what customers understand they are consenting to. A feature designed to improve a product experience should not quietly become a channel for collecting and commercializing personal information for unrelated purposes.
The responsibility for keeping customers’ data safe also extends to the third-party vendors organizations use.
Because many enterprises rely heavily on third-party vendors, and because data is shareable, those vendors may access some of their customers’ data. That means organizations must ensure that their vendors use the data, if necessary, strictly for the intended purposes and do not share it with unauthorized parties.
Must-read security coverage
- UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case
- Blackpoint Cyber vs. Arctic Wolf: Which MDR Solution is Right for You?
- How GitHub Is Securing the Software Supply Chain
- 8 Best Enterprise Password Managers
What GM owners and other drivers should do now
The GM settlement is a reminder that connected vehicles can collect more personal information than drivers might realize, including where they travel and how they drive.
Drivers should start by reviewing the privacy settings in their automaker’s mobile app or connected-vehicle account. Look for features that monitor driving behavior, track location, or allow information to be shared with third parties. Disable any optional data collection that you don’t need or feel comfortable with.
It’s also worth checking whether your automaker offers a way to request copies of your personal information or have it deleted. However, turning off a feature does not necessarily erase information that has already been shared with data brokers or insurance companies.
If you’re concerned about how your driving history could affect your insurance rates, ask your insurer what information it uses to calculate premiums and whether third-party driving data plays a role.
Ultimately, drivers should understand what information their vehicles collect, who can access it, and how that data might be used before agreeing to connected-car services.
Also read: For more on how vehicle surveillance technology is raising privacy concerns, read TechRepublic’s report on new license plate readers that can track phones, AirPods, and smartwatches.