A dashboard is supposed to tell you how fast you are going, not tell someone else. Attorneys general said Thursday that General Motors will pay $220 million to three dozen states to settle claims that it illegally sold the behavior and location data of nearly 10.3 million drivers to third parties, including data brokers that passed it on to insurers.

The Program at the Center

The states said GM enrolled millions of drivers in its Smart Driver program from 2016 to 2024. It promoted the tool as a way to improve safety behind the wheel and promised not to share the data it collected with insurers without express consent.

Selling Safety, Delivering Surveillance

According to Connecticut Attorney General William Tong’s office, GM sold the data to brokers under contracts specifying it was meant for insurance purposes. Tong said GM profited from the sales while drivers were hit with higher premiums.

“GM turned private vehicles into mobile insurance surveillance machines without consumer consent or awareness,” Tong said, calling it “an egregious violation of privacy.”

What Was Collected

The data was “personal, identifiable, and specific,” Tong’s office said. It included how often a person drove and when, how many times they braked or accelerated quickly, and whether they exceeded speed limits. Connecticut is owed more than $6 million under the deal.

Who Is Covered

According to Tong’s news release, the settlement resolves claims by enforcers in Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Hawaii, Idaho, Illinois, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington and Wisconsin.

GM’s Response

A GM spokesperson told Law360 the agreement “addresses Smart Driver, a product we ended in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.”

“Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” the statement said.

Prior Resolutions and Pending Litigation

GM said the settlement is consistent with earlier resolutions with California and the Federal Trade Commission. The January 2025 FTC deal included a five-year ban on disclosing geolocation and driver behavior data to consumer reporting agencies. GM separately faces multidistrict litigation over alleged privacy abuses in the Northern District of Georgia.

No Checks for Drivers

Michigan Attorney General Dana Nessel said the settlement does not offer customer restitution. A document from her office lists purposes for the state’s $7.2 million share, including investigation and litigation costs, future enforcement, consumer education, “or any purpose allowable under Michigan law.”

How Drivers Got Enrolled

The bipartisan coalition said most drivers signed up for Smart Driver at a dealership through a single process that also enrolled them in OnStar services, and some dealership employees agreed to terms and conditions without the driver’s consent.

The 370,000 Unenrolled Drivers

Illinois Attorney General Kwame Raoul’s office said OnStar’s app incorrectly told 370,000 customers they were not signed up for Smart Driver. GM later “quietly unenrolled those drivers without communicating the mistake,” but left their data with brokers and insurers.

Raoul said the company “took advantage” of its customers. Illinois will receive about $10.5 million.

New Rules for GM

The settlement requires GM to limit the data it collects and obtain “affirmative express consent” before collecting or sharing such data in the future, Raoul’s office said.

For millions of drivers, the settlement closes the states’ case, but it leaves the question of compensation to the courts still pending.