General Motors has agreed to a $220 million settlement with 36 U.S. states over accusations that it improperly sold drivers' private data. The lawsuit focused on GM’s practice of sharing detailed driving behavior and location information collected through its Smart Driver program with data brokers, who then provided the information to insurance companies. GM ended the Smart Driver program in 2024 and is now required to obtain explicit consent from drivers before collecting or sharing such data as part of this settlement. Additionally, the agreement mandates independent third-party reviews to ensure GM complies with its enhanced privacy measures.

The settlement resolves a coalition-led lawsuit stemming from revelations in a 2024 New York Times investigation, which exposed how GM and its OnStar service shared real-time vehicle data with third parties like LexisNexis and Verisk. This information included precise geolocation and driver behavior that could impact insurance rates. Previously, GM had also reached an agreement with the Federal Trade Commission in January 2026 to restrict the sharing of consumer data and improve transparency regarding data collection practices.

GM emphasized that while it will no longer sell driver-specific vehicle data, the company may still share anonymized data without identifiable links to individuals. The automaker has updated its privacy policies and launched a new consumer-centric Privacy Center to give users more control over their information. GM framed these changes as part of its commitment to offer safer, more personalized connected vehicle experiences while protecting user privacy.

These developments come as the automotive industry increasingly integrates advanced sensors and computing technology in vehicles. For instance, GM is rolling out a new AI-powered personal assistant for OnStar, which uses vehicle cameras and voice controls to enhance driver convenience and safety features. The company plans to preserve user privacy by encrypting recorded data and enforcing strict controls on data access, though opting out of data sharing may limit access to some functionalities.