GM's $220 Million Privacy Settlement Raises Questions About Vehicle Tracking and Personal Data

General Motors has agreed to pay $220 million to settle allegations that it collected and sold sensitive information about millions of American drivers without obtaining appropriate consent.

The settlement, announced on October 29, 2026, follows an investigation involving a coalition of 36 state attorneys general. It concerns GM's discontinued Smart Driver program, which collected information about vehicle movements and driving behavior.

According to state authorities, the information was provided to third-party data brokers and subsequently sold to insurance companies, which could use it when determining customer premiums.

The case raises significant questions about location tracking, the commercial use of personal information and the responsibilities of organizations that collect or share sensitive customer data.

It also highlights how technology designed for one purpose can create additional privacy concerns when the information collected is used elsewhere.

What Happened in the General Motors Data Privacy Case?

Between 2016 and 2024, General Motors enrolled millions of customers in its Smart Driver program.

The service was promoted as a tool that could help drivers understand their driving habits and improve road safety.

However, the investigation conducted by state attorneys general found that GM supplied information collected through the program to data brokers under arrangements involving insurance-related products.

The brokers then provided information to insurance companies, potentially influencing the premiums charged to individual drivers.

The information included detailed records of driving activity, such as:

• The number of journeys made by individual drivers.
• The start and end times of vehicle trips.
• Instances of rapid acceleration or hard braking.
• Whether vehicles exceeded posted speed limits.
• Information concerning vehicle movements and locations.

State authorities alleged that consumers were not adequately informed about the collection and commercial use of this information.

The settlement resolves those allegations and introduces new requirements governing GM's collection and sharing of driving data.

General Motors discontinued its Smart Driver program in 2024.

How Drivers Were Allegedly Enrolled Without Proper Consent

One particularly significant aspect of the investigation concerns how customers were enrolled in the program.

According to the attorneys general, many drivers signed up for GM's connected vehicle services when purchasing a car from a dealership.

The enrollment process combined access to the company's OnStar services with participation in Smart Driver.

In some cases, dealership employees allegedly accepted terms and conditions on behalf of customers without obtaining their consent.

Investigators also identified commercial incentives encouraging dealerships to increase enrollment in connected vehicle services.

The allegations raise questions about whether customers had sufficient information to understand what they were agreeing to and how their personal data might subsequently be used.

The investigation also identified problems involving the information displayed to customers.

According to the settlement announcement, GM's OnStar application incorrectly informed more than 370,000 drivers that they were not enrolled in Smart Driver, despite their information being collected through the program.

GM subsequently removed those drivers from the program, but authorities alleged that their information remained with data brokers and insurance companies.

These findings illustrate how weaknesses in consent procedures and customer communication can create significant privacy concerns.

Why Vehicle Location Data Is Particularly Sensitive

Modern connected vehicles can collect substantial amounts of information about how and where they are used.

Depending on the technology involved, records may include location information, journey times, vehicle performance and driving behavior.

Individually, some of these details may appear relatively ordinary.

However, when combined over time, location and movement records can reveal patterns that provide considerable insight into an individual's activities.

For example, repeated journeys may indicate where someone lives, works or regularly spends time.

Detailed travel records may also reveal the timing and frequency of visits to particular locations.

This makes vehicle location information materially different from many other forms of routine consumer data.

The issue is not necessarily that collecting location information is inherently improper.

Connected vehicle technology can provide legitimate benefits, including navigation, maintenance monitoring, roadside assistance and other safety-related functions.

The concern arises when individuals do not understand what information is being collected, how it is being used or which organizations may receive it.

The Difference Between Vehicle Tracking and Professional Surveillance

The GM settlement also raises broader questions about the distinction between routine technological monitoring and professional Surveillance.

Commercial location tracking may occur through connected vehicles, mobile applications, telecommunications systems and other technologies.

Professional Surveillance, by comparison, generally involves targeted observation undertaken for a defined and lawful purpose.

For example, an attorney may instruct an investigator to document activities relevant to litigation, or a business may require factual observations concerning suspected misconduct.

The circumstances, legal authority and methods used are important considerations.

The existence of commercially available location data does not automatically establish that another party is entitled to obtain or use it.

Similarly, the ability to track a person's movements through technology does not remove the need to consider privacy protections and applicable legal restrictions.

Conflict International USA provides Surveillance Services for legal professionals, businesses and private clients where lawful, proportionate observation is appropriate.

These services are distinct from the mass collection and commercial sale of consumer location information described in the GM settlement.

Third-Party Data Sharing Creates Additional Risks

One of the central issues in the GM case concerns the movement of personal information between different organizations.

According to state authorities, GM collected driving information, supplied it to data brokers and allowed that information to reach insurance companies.

Each additional organization involved in handling sensitive information can introduce further questions about access, security, consent and accountability.

For businesses that rely on third-party technology providers, these issues extend beyond vehicle manufacturers.

Organizations may share sensitive customer information with software vendors, analytics providers, insurers, consultants and other commercial partners.

Before entering such arrangements, businesses should understand what information will be transferred and how the receiving organization intends to use it.

Relevant considerations include:

• Whether the information is necessary for the intended service.
• What contractual restrictions govern its use.
• Whether further disclosure to additional parties is permitted.
• How customer consent and privacy preferences are managed.
• What safeguards protect the information.
• Whether data retention and deletion requirements are appropriate.
• How compliance with agreed restrictions will be monitored.

These questions may form part of broader Third-Party Due Diligence and corporate governance reviews.

Conflict International USA provides Due Diligence Services to organizations assessing commercial partners, suppliers and other third-party relationships.

Such enquiries can help businesses understand relevant corporate structures, regulatory histories and potential risks associated with external organizations.

Technical data privacy and regulatory compliance assessments may require additional specialist expertise.

What Does the $220 Million Settlement Require?

The settlement introduces several requirements intended to strengthen consumer privacy protections.

General Motors must obtain affirmative, express consent before collecting or disclosing covered driving and location information.

The company must also limit the information it collects and implement measures to protect personal data.

Additional requirements include internal and external assessments of its privacy and data protection arrangements.

The settlement also addresses dealership practices, requiring improved oversight and training to reduce the risk of customers being enrolled in data collection programs without proper authorization.

These measures reflect a broader regulatory focus on how businesses obtain consent and manage personal information across different commercial relationships.

The agreement does not establish that every form of vehicle monitoring is unlawful.

Instead, it addresses the specific allegations concerning GM's collection, disclosure and commercial use of customer data.

The $220 million settlement is payable to the participating states and does not itself provide direct consumer restitution. Separate private litigation concerning the conduct remains pending.

What Can Businesses Learn From the GM Settlement?

Although this case concerns the automotive industry, the underlying issues are relevant to organizations using connected technologies and customer information.

Businesses increasingly rely on digital systems that generate substantial volumes of data.

Information originally collected to provide a service may later become commercially valuable for analytics, marketing, risk assessment or other purposes.

However, the availability of information does not automatically justify its use for additional purposes.

Organizations need to understand the relationship between the information they collect and the expectations communicated to their customers.

They should also consider whether internal incentives, sales practices or third-party arrangements create risks that existing procedures do not adequately address.

The GM investigation demonstrates that privacy exposure can arise through a combination of operational decisions rather than a single technical failure.

For businesses, reviewing data-handling arrangements and assessing external relationships can help identify concerns before they develop into regulatory disputes.

Growing Scrutiny of Location Data and Corporate Accountability

The General Motors settlement represents a significant development in the regulation of consumer location data in the United States.

The financial penalty, the involvement of 36 state attorneys general and the introduction of additional consent requirements demonstrate the potential consequences of inadequate information-handling practices.

The case is particularly notable because the information concerned was capable of revealing detailed patterns of individual movement and driving behavior.

As connected technologies become increasingly common, businesses and consumers face important questions about how personal information is collected, retained and shared.

For organizations handling sensitive data, effective oversight requires an understanding of both internal practices and third-party relationships.

Conflict International USA supports corporations, attorneys and private clients through Surveillance, Due Diligence, Cyber Security and specialist investigative services.

Our team provides proportionate, evidence-led assistance to organizations seeking to understand relevant commercial relationships, establish facts and assess potential risks.

To discuss a corporate investigation, Due Diligence requirement or lawful Surveillance assignment, contact Conflict International USA for a confidential consultation.