Attorney General James Secures $220 Million from General Motors for Selling Drivers’ Private Data

NEW YORK – New York Attorney General Letitia James today joined a bipartisan coalition of 35 other attorneys general in securing $220 million from General Motors (GM) for illegally selling drivers’ private driving and location data to data brokers who then sold the information to insurance companies. Following an investigation by Attorney General James and the coalition, GM will pay $220 million, including more than $12 million to New York, and limit the data it collects from consumers to protect their personal information as part of a comprehensive data privacy program.

“New Yorkers should never have to worry about a car company tracking their every move when they get behind the wheel,” said Attorney General James. “General Motors collected data on their customers’ personal driving habits without their knowledge and then sold it, potentially affecting their insurance rates. Today, we are putting a stop to this illegal violation of drivers’ privacy.”

From 2016 to 2024, GM enrolled millions of drivers in their Smart Driver program, which tracked driving habits such as how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit. Over 700,000 New York drivers are enrolled in Smart Driver. GM pitched the program as a way for drivers to improve their own driving safety and told drivers that they would not share their data with insurers without express consent.

Attorney General James and the coalition’s investigation found that in reality, GM sold this information to data brokers under contracts that specified the data was to be used for insurance products. The data brokers sold the data to insurance companies, who could then change the drivers’ premiums based on their driving habits. GM did not disclose to drivers that their data would be sold for this purpose.

An investigation by The New York Times found that some drivers saw significant increases to their premiums after GM sold their driving history to data brokers. One GM owner was told by an insurance broker that the 22 percent increase in their car insurance premium was caused by personal driving information provided by a data broker. The driver obtained a copy from the 130-page report and found that GM had extensive details related to every time their car had been driven over the past six months.

Most customers who signed up for Smart Driver did so at the GM dealership when they purchased a vehicle. GM used one sign-up process for drivers to enroll in Smart Driver and GM’s OnStar service, which connects drivers with directions, security, and roadside assistance. In many cases, dealership employees allegedly accepted terms and conditions on behalf of customers without their consent. Attorney General James and the coalition’s investigation found that GM incentivized their dealers to sign up as many customers as possible for the Smart Driver program. Between 2020 and 2024, GM heavily incentivized dealership employees through bonuses based in part on how many customers they signed up for GM’s connected vehicle services, including Smart Driver, and dealerships were ranked based on their enrollment numbers.

GM’s own systems failed to notify drivers about whether their data was being tracked. The OnStar app mistakenly told over 370,000 drivers that they were not enrolled in Smart Driver, when in reality, GM was collecting and selling their data through Smart Driver. GM later quietly unenrolled those without telling them about the mistake, and left their data with the data brokers and insurance companies.

The data GM sold was personal, identifiable, and specific. Data brokers purchased extensive reports detailing every trip taken by drivers. Insurance companies then purchased the information and could potentially use it to change rates even for drivers that hadn’t filed any claims.

As a result of the coalition’s investigation, GM must pay $220 million to the states, including $12,054,341 to New York, and limit the driving data it collects from consumers to protect their personal information as part of a comprehensive data privacy program. GM will also establish an in-house data and privacy protection assessment program in addition to a third-party data protection and privacy assessment program to ensure it is abiding by best practices. GM is also required to implement oversight and training requirements at their dealerships to protect consumers from being enrolled in data collection schemes without their consent.

Attorney General James is a leader in holding companies accountable for failing to follow the law around consumers’ personal data. In July 2026, Attorney General James secured $18 million from 23 and Me for failing to protect customers’ genetic data. In November 2025, Attorney General James secured $5.1 million from Illuminate Education after sensitive student data was stolen in a data breach. In October 2025, Attorney General James announced her office secured $14.2 million from eight car insurance companies for failing to protect the private information of more than 825,000 New Yorkers. In March 2025, Attorney General James secured $975,000 from Root, an auto insurer, and sued Allstate for failing to protect New Yorkers’ information. In January 2025, Attorney General James secured $450,000 from three companies that distributed home security video cameras for failing to secure consumers’ private home security videos.

Joining Attorney General James in securing this settlement are the attorneys general of Alabama, Alaska, Arizona, Colorado, Connecticut, Delaware, Florida, Hawai’i, Idaho, Illinois, Kansas, Kentucky, Maine, Massachusetts, Maryland, Michigan, Mississippi, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, Wisconsin, and the District of Columbia.

For New York, this matter was handled by Deputy Bureau Chief Clark Russell under the supervision of Bureau Chief Kim Berger of the Bureau of Internet and Technology. The Bureau of Internet and Technology is a part of the Division for Economic Justice, which is led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Meghan Faux.