GM’s $220 Million Driver Data Case Puts Connected Car Privacy in Focus

The practical lesson from General Motors’ $220 million agreement with 35 states and the District of Columbia is that connected car data can travel far beyond the vehicle. Driving records gathered through GM’s Smart Driver program could reach insurance companies, where they might affect what customers pay. For drivers, the case puts a consequential question in focus: what does a carmaker do with the information its vehicles collect?

Dealerships offered Smart Driver to customers from 2016 through 2024. The program collected information about driving habits, and GM sold some driver data. A 2024 New York Times investigation described cases in which insurers used that information when setting rates. One driver was told a 22% premium increase resulted from driving information supplied by a data broker, according to a statement from the New York attorney general’s office.

That connection is what makes vehicle data more than a product analytics issue. A record of driving behavior may have consequences outside the car, especially when customers don’t understand what they agreed to share or how the information might be used downstream.

Consent is the central change

The agreement requires GM to obtain affirmative express consent before collecting or disclosing consumers’ driving and location data. That requirement shifts the focus from a broad privacy notice toward a clear choice at the point where data use is proposed. For drivers, the useful details are which data a feature needs, who may receive it, and whether sharing is optional.

GM ended Smart Driver in 2024 after scrutiny of the program. In 2025, the company reached a separate agreement with the Federal Trade Commission covering Smart Driver and OnStar location data, including a five-year ban on selling driver data. The newer $220 million agreement adds a consent requirement and is a distinct part of the response.

In a statement to CNET, a GM spokesperson said the company had strengthened its privacy practices since ending Smart Driver. GM said it had updated and simplified its US privacy statement, created a Privacy Center, and enhanced internal controls for connected vehicle data. The company also argued that connected data can enable safer, more helpful and personalized experiences, while saying customers should have clear information about its use and protection.

Those changes describe the company’s approach, but the test for drivers is whether the choices are understandable and specific. A setting that bundles multiple uses together can make consent hard to assess. Peter Cassat, a technology partner at CM Law and former general counsel for Cox Automotive and New Country Motor Group, said vehicle providers should seek consent feature by feature, using plain English rather than relying on a single box for buyers to check.

Cars gather data in the background

Modern vehicles are connected systems. Alongside location and diagnostic information, they may handle phone contacts and music lists. Some data moves through the vehicle’s built-in modem to the manufacturer, so a driver’s privacy choices can involve more than the dashboard settings they see each day. Phone connections, location services and other connected features can also affect what information is available.

The tradeoff is familiar to anyone who uses a connected device: data can support useful services, but transmitting it creates questions about collection, access and retention. In a car, those questions are harder to monitor because the information may be gathered while the driver is focused on the road, and opting out may mean giving up features.

Clyde Williamson, a senior security architect at Protegrity, has compared the privacy risks of modern cars with those of smartphones. He said drivers may not give vehicles the same security scrutiny they give other connected devices, even though cars can collect detailed information. His advice is to opt out where possible, decline unnecessary sharing, review a Customer Disclosure Report for driving data, and consider disabling the modem if the vehicle allows it.

What drivers and carmakers should watch

Cassat described driving data collection and sale as common across the auto industry, rather than an isolated practice. He said the GM case gives state attorneys general a model to consider in future cases. That’s his assessment, but the broader point is clear: a company’s data practices can become a customer issue when information collected for one service is later used in a different context.

For drivers, the immediate steps are practical: review privacy settings, check which connected features are enabled, and look for information about data sharing in the vehicle’s disclosures. Those steps can’t guarantee that every data flow is visible, and disabling connectivity may reduce convenience. Still, knowing what a car sends and what choices are available is a useful starting point.

For automakers, the harder task is making consent meaningful across a growing set of connected services. The next measure of progress will be whether drivers can understand each data use before agreeing to it—and change their minds without losing access to basic vehicle functions.