General Motors has agreed to pay $220 million to settle allegations that it sold drivers’ personal information—including location and detailed driving-habit data—to data brokers, resolving a complaint brought by a coalition of 36 U.S. attorneys general. The settlement, reported by The Verge and other outlets, requires the automaker to restrict the data it collects and to obtain express consent from drivers before collecting information about them.

The case centers on GM’s now-discontinued Smart Driver program, which gathered data on acceleration, braking, trip length and other driving behavior. According to allegations summarized in settlement coverage, GM passed that information to data brokers, who in turn made it available to insurance companies. Insurers could use the data to inform pricing, underwriting or usage-based insurance products—turning everyday driving into a commodity that drivers may not have understood was being sold.

What the settlement requires

Under the agreement, GM must limit the driving data it collects and obtain express consent before collecting driver information. The consent requirement is significant: it moves GM from a model in which data collection may have been buried in terms or default settings to one in which drivers must affirmatively agree. The settlement also resolves claims that the company illegally sold driver and location information, according to The Verge, which reported the agreement earlier via Reuters.

“Express consent” — the standard GM must now meet before collecting driver information, according to the settlement — is at the heart of the agreement.

Ohio’s share and local framing

Local coverage highlighted how the national settlement translates into state-level payments. MSN reported that GM will pay Ohio $8 million over allegations that it secretly sold driver data. That state-by-state breakdown matters politically: attorneys general often frame privacy settlements as consumer-protection wins, and the Ohio figure gives residents a concrete measure of the penalty. The broader MSN headline described the case as “secret driver tracking and data sales to insurers,” emphasizing concealment and the insurance pipeline rather than the technical details of the Smart Driver program.

How the story is being framed

The Verge’s coverage focused on the mechanics of the data economy: how driving-habit data flows from a carmaker to brokers and then to insurers, and what the settlement does to change that flow. Finance and market outlets, meanwhile, treated the $220 million figure as the headline—a material but manageable cost for a large automaker—while local outlets focused on the Ohio allocation. Together, the coverage shows a single event being read through three lenses: privacy regulation, corporate finance and state-level accountability.

The allegations are especially sensitive because modern vehicles are effectively smartphones on wheels. Cars generate data on speed, braking, acceleration, location, trip frequency and more. That information can be valuable to insurers, marketers and data brokers. Privacy advocates have long warned that drivers may not realize how much data their vehicles collect or how it can be shared. The GM case gives those warnings a concrete example: a feature marketed around safe-driving feedback allegedly became a conduit for commercial data sales.

Why consent is the crux

The settlement’s consent requirement addresses a familiar problem in privacy enforcement. Notice-and-consent regimes are often criticized because few consumers read privacy policies, and consent may be bundled into broader terms. Requiring express consent for driving data—rather than relying on implied or generic agreement—raises the bar. If enforced, it could force automakers to design clearer prompts and give drivers more meaningful choices about what their vehicles record and share.

  • Who: General Motors and a coalition of 36 U.S. attorneys general, with Ohio receiving $8 million.
  • What: A $220 million settlement over allegations GM sold driver and location data from its Smart Driver program.
  • Why it matters: The agreement limits data collection and requires express consent, setting a potential template for connected-car privacy.
  • How the data was used: Allegedly passed to brokers and purchased by insurers, potentially affecting insurance decisions.

Implications for connected cars

The settlement arrives as regulators and consumers pay more attention to automotive privacy. Modern vehicles collect telematics, location and behavioral data, and the line between safety features and commercial surveillance can be blurry. GM’s Smart Driver program has been discontinued, but the case is likely to influence how automakers design future features, write privacy disclosures and negotiate with data partners. It also signals that state attorneys general are willing to coordinate across jurisdictions and pursue large penalties over data practices.

For drivers, the practical question is whether the settlement produces lasting changes beyond a headline number. The consent requirement and data limits are the substantive provisions; the $220 million is the penalty. Whether other automakers adopt similar standards—or whether this remains a one-company settlement—will determine how far the precedent reaches. For now, the agreement makes clear that driving data is not just a technical byproduct. It is a business asset, and regulators are treating its sale as a consumer-protection issue.