PHOENIX – General Motors (GM) has agreed to pay $220 million to settle allegations that the automaker collected and sold millions of consumers’ private driving records and location data without their informed consent. The information was sold to third-party data brokers, who then provided it to insurance companies that could use the data to determine drivers’ insurance premiums.
Arizona will receive $5.9 million as part of the multistate settlement, which also imposes new restrictions on GM’s collection, use, and disclosure of consumer information.
According to the allegations, GM enrolled millions of drivers in its Smart Driver program between 2016 and 2024, marketing the service as a tool to help motorists monitor their driving habits and improve safety.
GM assured customers that their driving information would not be shared with insurance companies without their express consent. However, investigators found that the automaker sold the information to data brokers under agreements specifically allowing its use in insurance-related products.
Those brokers subsequently provided the information to insurance companies, which could use it to adjust customers’ premiums based on their driving behavior.
Customers Allegedly Enrolled Without Their Knowledge
The investigation also uncovered widespread problems with how customers were enrolled in GM’s Smart Driver program.
Many consumers were signed up at dealerships while purchasing vehicles through a combined enrollment process for Smart Driver and GM’s OnStar connected vehicle services.
In some instances, dealership employees allegedly accepted terms and conditions on behalf of customers without obtaining their permission.
At the time, GM offered financial incentives to dealerships and sales employees to increase enrollment in its connected vehicle services. Sales personnel could earn bonuses based partly on enrollment numbers, while dealerships were ranked according to their participation rates.
More Than 370,000 Drivers Misled About Data Collection
Investigators also found that GM’s own technology provided inaccurate information to hundreds of thousands of customers.
The OnStar application incorrectly informed more than 370,000 drivers that they were not enrolled in Smart Driver, even though GM was actively collecting and selling their driving information.
GM subsequently removed those customers from the program without notifying them of the error. Their previously collected information remained in the possession of data brokers and insurance companies.
The information sold by GM was detailed enough to identify individual drivers and track their behavior behind the wheel.
Records included the frequency of vehicle use, the starting and ending times of trips, incidents of hard braking or rapid acceleration, and instances when drivers exceeded posted speed limits.
As reported by The New York Times, insurance companies used such information when evaluating customers’ rates, sometimes resulting in higher premiums.
GM discontinued the Smart Driver program following the newspaper’s reporting.
Settlement Imposes New Privacy Protections
Beyond the $220 million financial settlement, GM must implement extensive changes to its consumer data practices.
The agreement requires GM to obtain affirmative, express consent before collecting or disclosing consumers’ driving behavior and location information.
The company must also establish a comprehensive privacy protection program, undergo internal and independent external assessments, and comply with additional oversight requirements.
GM dealerships will face new training and monitoring requirements intended to prevent employees from enrolling customers in data collection programs without their knowledge or authorization.
The coalition of attorneys general secured privacy protections that go beyond those contained in previous resolutions involving GM’s data collection practices.
Arizona Joins Nationwide Enforcement Action
The case was co-led by the attorneys general of Washington and Oregon, with assistance from an executive committee representing Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont.
Arizona joined attorneys general from Alabama, Alaska, the District of Columbia, Florida, Hawaii, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, and Wisconsin in the enforcement action.
The settlement addresses allegations that GM failed to adequately disclose how consumers’ personal driving information would be collected, shared, and ultimately used by insurance companies to make decisions affecting their premiums.
Be the first to comment