GM to pay $220M to 36 state attorneys general over sale of OnStar Smart Driver location and driving data to data brokers
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 31/10/2026 00:02; os links antigos trazem para cá.
Fontes: theregister.com ↗ techcrunch.com ↗
General Motors agreed to pay $220 million to settle allegations by 36 attorneys general that it collected drivers' precise geolocation and driving-behavior data and sold it to data brokers, which resold it to insurers. The settlement was announced by the Washington AG's office on 2026-10-29 (theregister.com). The data came from the Smart Driver program in GM's connected-car apps and OnStar. The practice was exposed by a 2024 New York Times investigation that named brokers LexisNexis and Verisk (techcrunch.com). GM ended Smart Driver in 2024. The FTC finalized its own order against GM and OnStar in January 2026. Both sources stress this is a privacy and regulatory enforcement matter, not a cyber intrusion or breach. The new settlement requires express consent for collecting or sharing driving and location data and adds a third-party assessment of GM's privacy program (techcrunch.com).
Detalhes técnicos
- Smart Driver was a free, opt-in-by-default feature that tracked and scored driving behavior and seat belt use (techcrunch.com). The collected data included precise location, speed, seatbelt use and other driving data (theregister.com).
- GM had told customers it would not share this data with insurers without express consent (theregister.com).
- Dealerships were incentivized to enroll customers, and in some cases employees accepted the terms and conditions on customers' behalf without their knowledge (theregister.com).
- The OnStar app wrongly told more than 370,000 drivers they were not enrolled in Smart Driver while GM kept collecting and selling their data (theregister.com).
- Insurers bought the data from brokers with which GM had struck deals and could use it to set premiums (theregister.com; techcrunch.com).
- Related actions: the FTC finalized its settlement in January 2026, California reached a separate $12.75 million settlement in May 2026, and a Texas case is ongoing (theregister.com).
- Context: GM is expanding OnStar with an AI assistant and connected cameras (techcrunch.com).
Remediação
- GM must obtain express consumer consent before collecting or sharing driving and location data, and must undergo a novel third-party assessment of its privacy program (techcrunch.com).
- GM must limit the driving data it collects, better protect customer PII and establish a comprehensive data privacy program (theregister.com).
- The FTC order requires express consent before collecting, using or sharing covered driving data. It also requires a simple way for drivers to request a copy of their data, request deletion, and disable precise geolocation collection where vehicles support it (theregister.com).
- GM says it will no longer sell vehicle information linkable to an individual, their location or driving behavior, though anonymized data may still be shared with partners (techcrunch.com).
- GM has updated its privacy policy and added a consumer-facing Privacy Center, permissions management, and encrypted, time-limited Connected Camera recordings for the new OnStar assistant (techcrunch.com).
Relatos divergentes
- Scope of the coalition: techcrunch.com says "36 states". theregister.com, the later source, specifies 36 attorneys general made up of 35 states plus the District of Columbia, which is the more precise figure.
- End of Smart Driver: techcrunch.com says only that GM discontinued it in 2024. theregister.com gives April 2024.
Linha do tempo
-
GM agrees to $220M settlement with 36 state AGs over sale of driver tracking data to insurance-supplying data brokers
ler a análise desta fonte ocultar
General Motors agreed to a $220 million settlement with 36 attorneys general (35 states plus the District of Columbia), announced by the Washington AG's office on 2026-10-29. The AGs allege GM collected precise location, speed, seatbelt use and other driving data through the OnStar Smart Driver program without informed consent and sold it to data brokers that supplied insurers. GM had told customers it would not share this data with insurers without express consent. The practice was exposed by a 2024 New York Times investigation, and GM ended Smart Driver in April 2024. This is a privacy and regulatory enforcement matter, not a cyber intrusion.
Technical Details
- Dealerships were incentivized to enroll customers in Smart Driver, and in some cases employees accepted terms and conditions on customers' behalf without their knowledge.
- The OnStar app incorrectly told more than 370,000 drivers they were not enrolled in Smart Driver while GM kept collecting and selling their data.
- Insurers obtained the data by purchasing it from brokers with which GM had struck deals, and could use it to set premiums.
- The FTC finalized a settlement with GM on the same allegations in January 2026. California reached a separate $12.75 million settlement in May 2026. A Texas case is ongoing.
Remediation
- Under the settlement, GM must limit the driving data it collects, better protect customer PII and establish a comprehensive data privacy program.
- The FTC order requires express consent before collecting, using or sharing covered driving data. It also requires a simple way for drivers to request a copy of their data, request its deletion and disable precise geolocation collection where vehicles support it.
-
GM to pay $220M in 36-state settlement over selling drivers' location and behavior data to brokers
ler a análise desta fonte ocultar
General Motors will pay $220 million to settle allegations by attorneys general from 36 states that it illegally sold drivers' precise geolocation and driving-behavior data to data brokers, which resold it to insurers. The data was harvested via GM's Smart Driver program inside its connected-car apps and OnStar, and brokers LexisNexis and Verisk were named in the 2024 New York Times reporting that triggered the legal actions. GM discontinued Smart Driver in 2024, and in January the FTC finalized an order barring GM and OnStar from sharing certain consumer data. The new settlement requires express consumer consent before collection or sharing of driving and location data, and adds a novel requirement for a third-party assessment of GM's privacy program. The case is a privacy and regulatory enforcement matter rather than a security breach, arriving as GM expands OnStar with an AI assistant and connected cameras.
Technical Details
- Smart Driver was a free opt-in-by-default feature in GM connected-car apps that tracked and scored driving behavior and seat belt use.
- Collected telemetry included precise geolocation and behavioral driving data, shared with data brokers and onward to insurance providers, potentially affecting premiums.
Remediation
- GM says it will no longer sell vehicle information linkable to an individual, their location, or driving behavior; anonymized data may still be shared with partners.
- Updated privacy policy and a consumer-facing Privacy Center; permissions management and encrypted, time-limited Connected Camera recordings for the new OnStar assistant.