GM Agrees to $220M Settlement Over Driver Data Spying

How the Smart Driver program hit owners' wallets

Between 2016 and 2024, GM dealerships enrolled buyers into the Smart Driver feature, presenting it as a benign connected-car perk. Behind the scenes, the automaker turned those vehicles into surveillance hubs, logging braking habits, sudden acceleration, speeding events, and precise trip routes. GM then quietly offloaded this telemetry to third-party data brokers.

The consequences landed straight on consumers' insurance bills. A landmark investigation in 2024 revealed that insurers used these broker feeds to re-evaluate customer risk scores. In one instance detailed by the New York attorney general, an owner was hit with a 22% insurance premium hike derived directly from data supplied behind their back.

Public outrage pushed GM to scrap the Smart Driver feature in 2024. A subsequent Federal Trade Commission settlement in 2025 slapped the automaker with a five-year ban on selling driver records. This latest $220 million state pact closes another massive legal front, mandating that GM secure affirmative express consent before touching driving or location telemetry.

The entire auto industry is built to harvest telemetry

While GM caught the sharpest regulatory blow, data brokering remains rampant across connected cars. Today's vehicles constantly push internal diagnostics, contact books, media habits, and real-time GPS coordinates back to corporate servers over embedded cellular modems. Much like unmonitored hardware where corporate CCTV software lets hackers into networks without proper controls, connected vehicles present sprawling attack surfaces and surveillance pipelines that drivers rarely suspect.

Automakers have long obscured these pipelines within sprawling terms of service signed during hurried dealership closings. The GM resolution sets an aggressive precedent: vague blanket waivers will no longer protect manufacturers who treat customer movement as a monetizable asset.

State regulators now possess an actionable blueprint for targeted investigations. With $220 million on the board, other brands that sell telemetry to risk assessment agencies should expect similar legal pressure.

What it means for you

If you bought or leased a GM vehicle manufactured between 2016 and 2024—including Chevrolet, GMC, Cadillac, or Buick models—your driving metrics may have been packaged and sold. GM has updated its US privacy portal, allowing drivers to view and manage connected data options. To protect your insurance profile, request a consumer disclosure report from insurance-focused reporting agencies to check if auto-telemetry was factored into your premium. Drivers can also review in-dash privacy settings or disable the vehicle's embedded telematics modem to halt unprompted background transmissions.

Modern cars collect as much personal telemetry as smartphones, but with far less consumer control. GM's penalty proves regulators are finally paying attention, yet reigning in predatory vehicle data collection across the entire sector will require lasting, systemic enforcement.