GM agreed to pay $220 million over the sale of drivers' data

Office of the New York State Attorney General2026-10-29Editorial review: reviewed

A bipartisan coalition of 36 attorneys general announced a $220 million settlement with General Motors over driving and location data it sold to data brokers, which the data brokers then sold to insurers. The announcement says the settlement does not describe the deal as an admission of liability.

Data brokersEnforcementLocation trackingConsumer privacy

This is the clearest recent illustration of how far personal data can travel after it leaves the consumer.

According to the New York Attorney General’s office, GM enrolled millions of drivers in a telematics program (“Smart Driver”) between 2016 and 2024 that recorded how often they drove, trip start and end times, hard braking and acceleration, and whether they exceeded the speed limit. The office says GM sold that information to data brokers under contracts specifying it was for insurance products; the brokers then sold it to insurers, who could use it to adjust premiums.

The announcement says GM told drivers it would not share data with insurers without express consent. It also alleges that dealership staff in many cases accepted terms on customers’ behalf, that GM incentivised dealerships to enrol drivers, and that an app incorrectly told more than 370,000 drivers they were not enrolled while their data was still being collected. The office further says one driver’s insurer attributed a 22% premium increase to a driving report obtained from a broker.

What the settlement requires. Per the announcement: $220 million total, more than $12 million to New York, limits on the driving data GM collects, an in-house and third-party privacy assessment program, and dealer oversight and training requirements.

What to read carefully. This is a settlement announced by regulators, not a court judgment. The press release does not state that GM admitted liability. Characterisations such as “illegally selling” are the Attorney General’s framing of the alleged conduct. That distinction matters when deciding what the case proves.

Why it matters for a data-rights reader. The data was not a secret file leaked by an attacker. It was product telemetry, sold through contracts. Consumers often do not know which of a product’s features create a data pipeline until a case like this makes it visible.

← All news & research