A connected car can remember more than its owner may expect. A trip’s location, driving habits and even seat-belt use can become data points—and, once shared, those points may travel far beyond the dashboard.
General Motors has agreed to pay $220 million to settle allegations brought by 36 states that it unlawfully sold drivers’ location and driving-behavior information to data brokers. The settlement requires the automaker to get drivers’ express consent before collecting or sharing covered data, and adds an independent check on whether GM follows its privacy program.
From driving score to insurance data
The case centers on Smart Driver, a free feature in GM’s connected-car apps that tracked and rated driving behaviors, including seat-belt use. The states alleged that GM sent the resulting information to data brokers, which then sold it to insurance providers. A New York Times report more than two years ago described data collected through the program reaching brokers LexisNexis and Verisk.
The interesting shift is what happens when ordinary driving becomes a record that can be analyzed and exchanged. A phone app might count steps; a vehicle can produce a detailed account of journeys and behavior on the road. That information may be useful for services, but if it reaches insurers, it could also influence decisions affecting a driver’s rates, as the reporting on Smart Driver warned.
GM ended Smart Driver in 2024, but the end of a product did not settle questions about how its data had been handled. The new multistate agreement follows a separate Federal Trade Commission order, finalized in January, that restricts GM and its OnStar telematics service from sharing certain consumer data. Both agreements require clearer disclosures and explicit consent for specified data collection.
Consent becomes part of the car’s interface
The settlement’s additional requirement is oversight: a third party must assess GM’s compliance with the privacy program it has established. That matters because privacy promises are difficult for customers to evaluate from a policy document alone. An external assessment is intended to test whether the rules are being followed, not merely written down.
GM says it will no longer sell vehicle information that can be linked to an individual, a vehicle’s location or the way it is driven. It may still share anonymized information that is not tied to an individual with certain partners. The company has also revised its privacy policy and set up a customer-facing Privacy Center.
Those distinctions matter. “Anonymized” data is meant to remove identifying links, while information associated with a specific person or vehicle can reveal much more. The settlement does not mean connected cars stop generating data; it makes permission, disclosure and limits on sharing central questions about how that data is used.
The next privacy test may speak back
That question is becoming more pressing as cars gain cameras, connected services and software features. GM is adding a personal AI assistant to OnStar, its safety and roadside-assistance service. The company says the system will connect to vehicle cameras for live views and crash- and safety-related recordings, while voice commands will let users control some functions, such as climate, and ask about vehicle features.
GM says customers will be able to manage permissions, that recordings will be encrypted and subject to time limits, and that GM and OnStar cannot access Connected Camera recordings. But the company also says opting out of data sharing may limit access to some features. That trade-off is familiar in digital services: more personalization can depend on more data, while choosing less sharing may mean getting less from the product.
A car’s data is not just a technical by-product. It can describe where someone goes and how they behave, then feed decisions made elsewhere. The settlement puts a sharper question in front of drivers and automakers alike: when a vehicle asks to share, will people understand what they are agreeing to—and what they lose if they say no?