What Happened
General Motors agreed to a $220 million settlement with 36 attorneys general over its handling of driving data. This data, collected through the Smart Driver program, included location, speed, and seatbelt use. Investigators allege GM sold this data to brokers, who then supplied it to insurers for setting premiums, without informed consent from drivers.
The attorneys general labeled the data as personal and identifiable. GM also finalized an FTC order in January 2026. California reached its own $12.75 million settlement in May, and a Texas case is ongoing.
Timeline
- 2024: A New York Times investigation reveals GM sold data from Smart Driver.
- April 2024: GM ends the Smart Driver program, citing customer feedback.
- January 2026: GM finalizes its settlement with the FTC, requiring express consent for data collection and sharing.
- May: California settles for $12.75 million.
- Later: The 36-attorney-general settlement of $220 million is announced, over two years after the investigation.
Which Controls Failed or Were Missing
The case highlights five distinct failures, each representing a gap in controls.
1. No Valid Consent for Secondary Use. Drivers enrolled for driving reports, but their data was also sold to brokers. Consent for one purpose doesn't cover resale.
2. Misleading Customer Statements. GM assured customers it wouldn't share data with insurers without consent. However, insurers obtained data from brokers. This is both a transparency and privacy issue.
3. Consent Captured by Others. Dealerships enrolled customers, sometimes without their knowledge. Consent must come directly from the individual.
4. Incorrect Status Displays. The OnStar app misled 370,000 drivers about their enrollment status. Your Preference Center should accurately reflect processing status.
5. Weak Downstream Governance. Once data reached brokers, drivers couldn't track or control it. GM's agreed remedies were not previously available.
What the Relevant Standard Requires
The settlements align with US and international standards you're likely familiar with.
Informed Consent and Freely Given Consent. Under GDPR Article 4(11), consent must be freely given, specific, informed, and unambiguous. Article 7(1) requires proof of consent. A dealership employee clicking terms fails these tests.
Purpose Limitation and Transparency. GDPR Article 5(1)(b) mandates data collection for specified purposes. Article 13(1)(e) requires disclosure of data recipients. Selling data to brokers for insurance is a separate purpose that wasn't disclosed.
Withdrawal. Article 7(3) mandates that withdrawing consent be as easy as giving it. Incorrect app status undermines this right.
California. The California Consumer Privacy Act and California Privacy Rights Act allow residents to opt out of data sales and require notice at collection. Precise geolocation is sensitive information, with rights to limit its use.
Impact Assessment. ISO/IEC 29134 outlines privacy impact assessment methodology. High-risk processing, like resale of location data, requires assessment before launch.
Lessons and Action Items for Your Team
Separate Consent by Purpose. Don't bundle feature subscriptions with data sales. Each purpose needs its own consent record and toggle.
Audit Privacy Promises Against Data Flows. Verify that notices align with actual data practices. Indirect data sharing routes count.
Prohibit Proxy Acceptance. Ensure individuals personally accept terms. Log how and when consent is given.
Review Incentives. Avoid tying compensation to enrollment counts. Focus on verified, valid enrollments.
Reconcile Preference Center with Reality. Regularly compare consent status displays with actual data processing. Any mismatch is a problem.
Map Data Broker Relationships. Document what each broker receives and restrict onward sales. Ensure audit and deletion rights.
Build Remedies Before They're Needed. Provide easy ways for users to access, delete, and manage their data.
Run Assessments for Data Products. Conduct assessments before launching location or behavioral data products.
The settlement highlights the need for robust consent management. These failures didn't require advanced technology to prevent, just clear consent, accurate records, and truthful interfaces.
