Ethical Hacking News
General Motors has agreed to a $220 million settlement with a coalition of states and the District of Columbia over allegations that the company collected and shared drivers' data without proper consent and sold it to data brokers that supplied insurance companies. The settlement includes conditions that GM must meet, including limiting the driving data it collects and establishing a "comprehensive data privacy program."
General Motors (GM) has reached a $220 million settlement with 36 states and the District of Columbia over allegations of collecting and sharing drivers' data without consent. GM's Smart Driver program collected data on vehicle owners, which was shared with data brokers and ultimately sold to insurance companies without customer consent. The settlement includes conditions for GM to limit driving data collection, protect customer Personal Identifiable Information, and establish a comprehensive data privacy program. The settlement marks a significant escalation in regulatory scrutiny of GM's data collection and sharing practices, following previous investigations and settlements. The agreement demonstrates the importance of ensuring customers' personal data is protected, and is welcomed by consumer advocacy groups.
The automotive giant, General Motors (GM), has reached a $220 million settlement with a coalition of 36 states and the District of Columbia, following allegations that the company collected and shared drivers' data without proper consent and sold it to data brokers that supplied insurance companies. The settlement, which will be distributed among the participating jurisdictions, equates to less than 7 percent of GM's $3.3 billion in net income attributable to stockholders for its third quarter, which ended on September 30, 2026.
The allegations against GM stem from its Smart Driver program, which collected data on vehicle owners and handed it back to them in reports designed to inform better driving habits. However, unbeknownst to Smart Driver subscribers, their data was also being forked over to data brokers despite GM telling customers it wouldn't share that information with insurers without their express consent. The insurers ultimately obtained the data by purchasing it from brokers with which GM had struck deals.
Furthermore, GM incentivized dealerships to enroll customers in Smart Driver, with employees in some cases accepting terms and conditions on customers' behalf without their knowledge or consent. The company also failed to notify many drivers that their information was being collected and shared. In one instance, GM's OnStar app incorrectly told over 370,000 drivers that they were not enrolled in Smart Driver, even as GM continued collecting and selling their data.
The Washington state AG's office described the settlement as "significantly stronger than any other resolution reached with GM for this conduct." The settlement includes a number of conditions that GM must meet, including limiting the driving data it collects, better protecting customer Personal Identifiable Information (PII), and establishing a "comprehensive data privacy program."
It is worth noting that this settlement comes more than two years after a 2024 New York Times investigation found that GM had been selling the data collected from vehicle owners through its Smart Driver program. The investigation revealed that GM had been collecting and sharing data on vehicle owners without their consent, and that the data was being sold to insurance companies that could use it to set customers' premiums.
The settlement is also notable because it marks a significant escalation in the regulatory scrutiny of GM's data collection and sharing practices. In January 2026, GM finalized a settlement with the Federal Trade Commission (FTC) that required the company to obtain drivers' express consent before collecting, using, or sharing covered driving data, subject to certain exceptions. The FTC order also required GM to offer a simple way for drivers to request a copy of their data, request its deletion, and disable precise geolocation data collection where their vehicles support it.
The state of California separately reached a $12.75 million settlement with GM in the matter in May, and a separate case in Texas is ongoing. The agreements demonstrate a growing trend of regulatory bodies taking a closer look at the data collection and sharing practices of major companies, and the importance of ensuring that customers' personal data is protected.
In response to the allegations, GM's spokesperson stated that the company is committed to being clear about what information is used, how it is protected, and the choices customers have about what they share. However, the company also acknowledged that it still stands by driver data collection as a best practice, citing the benefits of connected vehicle data in enabling safer, more helpful, and personalized experiences.
The settlement has been welcomed by consumer advocacy groups, who have long been critical of GM's data collection and sharing practices. The agreement demonstrates that regulatory bodies are taking a serious look at the data collection and sharing practices of major companies, and the importance of ensuring that customers' personal data is protected.
In conclusion, the $220 million settlement reached by GM is a significant development in the regulatory scrutiny of the company's data collection and sharing practices. The agreement demonstrates the importance of ensuring that customers' personal data is protected, and the growing trend of regulatory bodies taking a closer look at the data collection and sharing practices of major companies.
Related Information:
https://www.ethicalhackingnews.com/articles/GM-Agrees-to-220-Million-Settlement-for-Alleged-Misuse-of-Driver-Data-ehn.shtml
https://www.theregister.com/security/2026/10/30/gm-cracks-the-petty-cash-box-for-multistate-driver-tracking-settlement/5306721
Published: Fri Oct 30 12:05:39 2026 by llama3.2 3B Q4_K_M
