GM to pay Alaska $2.5 million over claims it sold driving data that reached insurers

General Motors will pay Alaska $2,508,188 to settle allegations that it sold drivers' private driving and location data to data brokers, who resold it to insurance companies, Acting Attorney General Cori Mills announced Thursday.

Insurers got records of how many times a person drove, when each trip started and ended, how often the driver braked or accelerated hard, and whether the driver went over the speed limit, according to the Alaska Department of Law. For many drivers, insurers used the data in part to set their rates, the department said.

Alaska is one of 36 attorneys general in the $220 million settlement. GM agreed to it without admitting any of the facts or liability alleged, according to the consent decree filed in Michigan, one of the coalition states. Going forward, GM must get drivers' affirmative express consent before it collects or shares their driving and location data.

From 2016 to 2024, GM enrolled millions of drivers in Smart Driver, a program that tracked their driving habits. GM pitched it as a way for drivers to improve their own safety, the department said, and told them it wouldn't share their data with insurers without their express consent.

The coalition found that GM sold the data to data brokers under contracts that specified it was to be used for insurance products, and that the brokers sold it to insurers, who could then change a driver's premium based on those habits. GM didn't tell drivers their data would be sold for that purpose, the department said.

Most drivers signed up at the dealership when they bought their car, through a single process covering both Smart Driver and GM's OnStar services. In many cases, dealership employees allegedly accepted the terms on customers' behalf without their consent, the department said. At the time, salespeople earned bonuses based in part on how many customers they signed up for GM's connected vehicle services, and dealerships were ranked by their enrollment numbers, according to the department.

The OnStar app also mistakenly told more than 370,000 drivers they weren't enrolled in Smart Driver when they were, the department said. GM later unenrolled them without telling them about the mistake, and their data stayed with the brokers and insurers.

GM ended Smart Driver in 2024, after The New York Times reported on the practice, according to the department. The Times reported that insurers used the data to change rates, sometimes raising premiums.

Under the decree, GM must delete driving data it kept from before Jan. 16, 2025, within 180 days of the decree taking effect Nov. 30. There are exceptions, including litigation holds, safety recalls and warranty work. GM can instead email drivers asking to keep their data, and must delete it for anyone who doesn't answer within 30 days.

GM must also give drivers an easy way to request a copy of their driving data and a list of the kinds of companies it shared the data with.

Within 60 days, GM must train dealership staff to let customers review the privacy disclosures and accept them themselves before enrolling in OnStar. It must also limit the driving data it collects and undergo internal and outside assessments of its privacy program.

GM must pay the $220 million to the states within 30 days of Nov. 30. The department didn't say how Alaska would use its share.

The settlement follows a federal order. In January, the Federal Trade Commission finalized an order barring GM for five years from sharing drivers' location and driving behavior data with consumer reporting agencies. In May, GM agreed to pay $12.75 million to settle with California authorities.