GM will pay $220 million over driving data, and Ford says it never sells that data to brokers

General Motors agreed to pay $220 million to resolve claims from a bipartisan group of 36 attorneys general that it collected drivers’ speed, braking and location data and passed it to data brokers. Ford, in the same news cycle, announced a privacy commitment that includes a flat statement: it never sells information about how its customers drive to data brokers.

The tech news worth your time: 400,000+ professionals from Google, Apple and OpenAI read Techpresso, a daily email with the most interesting tech news and insights.

Subscribe to Techpresso →

We may earn a commission if you sign up.

The money closes out a feature called Smart Driver, which GM ran for owners from 2016 until it was discontinued in 2024. Millions of people were enrolled, many without realizing it, and the information eventually reached insurers that used it in setting premiums. Both companies are now trying to define what a connected car is allowed to know about the person behind the wheel.

Smart Driver enrollment at the dealership counter

The Washington Attorney General’s release, dated October 29, says GM promoted Smart Driver as a driving-safety tool and told customers their data would not go to insurers without express consent. The investigation found GM sold the data to brokers under contracts stating it would feed insurance products, and that drivers were never told. Most enrollments happened at dealerships during a purchase, bundled with an OnStar subscription, and the state alleges sales staff sometimes accepted the terms on a customer’s behalf. Employees earned bonuses tied to enrollment, and stores were ranked against each other.

The records at issue included trip counts, start and end times, hard braking, rapid acceleration and speeding. The OnStar app also told more than 370,000 drivers they were not enrolled when they were, and GM later unenrolled them without notice, leaving their history with brokers and insurers. Carscoops reports the buyers included LexisNexis and Verisk, and that GM ended those deals about two weeks after a New York Times story on March 11, 2024.

Consent-decree terms and a payout shared by 36 offices

Washington and Oregon co-led the coalition, with an executive committee of ten more states and 24 other jurisdictions, the District of Columbia among them. Washington will receive $12.3 million of the total. Under the consent decree, GM must obtain affirmative express consent before it collects or discloses driving and location data, limit what it gathers, run a comprehensive privacy program with internal and outside assessments, and train and supervise dealership staff so nobody is signed up without agreeing. Washington Attorney General Nick Brown said the state is proud to lead the bipartisan agreement, adding that residents’ data is personal and valuable and they should always control how it is used.

Oregon Attorney General Dan Rayfield put it more bluntly, as Insurance Journal relayed: “People bought a car, not a tracking device.”

A GM spokesperson responded that safer, more helpful and personalized experiences are enabled by connected vehicle data, and that the agreement reinforces the company’s privacy practices. By The Register’s arithmetic, the payment is under 7 percent of the $3.3 billion GM reported as third-quarter net income attributable to stockholders, which helps explain why the company can describe the outcome as a reinforcement rather than a reckoning.

The FTC order, California’s penalty and a Texas case still open

The multistate deal is not GM’s first settlement over the same conduct. The Federal Trade Commission order, proposed in January 2025 and finalized in January 2026 according to The Register, bars GM from giving geolocation and driver-behavior data to consumer reporting agencies for five years, and it requires express consent for collection. In May 2026, California Attorney General Rob Bonta announced a $12.75 million civil penalty, the largest under the state’s consumer privacy law to date, saying companies cannot hold data and reuse it later for another purpose.

A Texas case against GM is still ongoing, so the $220 million does not necessarily close the book on the company’s exposure.

Ford’s three privacy principles and what opting out costs

Ford’s announcement, covered by Autoblog on November 3, rests on three principles: privacy considered from data collection through storage and disposal, with anonymization and aggregation where useful; plain-language explanations of what is collected and where it goes; and owner control over sharing by service. The company launched a dedicated data and privacy page that carries the statement on driving data and links to settings and notices.

Ford is candid that control has a price. Connected vehicles can gather diagnostic data, driving characteristics and location, and Ford says that information powers embedded navigation, real-time traffic and roadside assistance. An owner who opts out from the car’s screen may lose BlueCruise, internet access or the ability to track the vehicle in the Ford App. Vehicles from 2018 onward should have privacy settings on the infotainment display, and Ford cites a survey of just over 1,000 American consumers, owners of Ford and other brands, saying privacy matters and permissions should be changeable at any time. Autoblog does not report the survey’s name, date or method.

The promise is also narrow. Ford’s page covers how a customer drives, not every category a connected car records, and the settlement shows how much turns on consent that is genuine rather than bundled into a purchase. Whether regulators test Ford’s wording the way 36 attorneys general tested GM’s remains an open question.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The tech news worth your time: Subscribe to Techpresso →

We may earn a commission if you sign up.