GM will pay Alaska $2.5 million to settle allegations it sold drivers' data to insurers

General Motors will pay Alaska $2,508,188 to settle allegations that it sold drivers' private driving and location data to data brokers who resold it to insurance companies. Acting Attorney General Cori Mills announced the settlement Thursday.

Alaska is part of a coalition of 36 attorneys general in the $220 million agreement. GM agreed to it without admitting any of the facts or liability alleged, according to the consent decree.

The settlement requires GM to get affirmative express consent from drivers before it collects or shares their driving and location data. The Department of Law said that for many consumers, insurers used the data in part to set their rates.

"This holds GM accountable and reinforces our commitment to safeguarding Alaskans' personal information," Mills said.

From 2016 to 2024, GM enrolled millions of drivers in its Smart Driver program, which tracked driving habits. GM pitched it as a way for drivers to improve their own safety and told them it would not share their data with insurers without express consent, the department said. The coalition found GM sold the data to data brokers under contracts that specified it was to be used for insurance products, and GM did not tell drivers their data would be sold for that purpose.

Insurers received records of how many times a person drove, when each trip started and ended, how often the driver braked or accelerated quickly and whether the driver went faster than the speed limit. The department said insurers could then change a driver's premium based on those habits.

Most drivers signed up at the dealership when buying a car, through one process covering both Smart Driver and GM's OnStar services. The department said dealership employees in many cases allegedly accepted the terms on customers' behalf without their consent.

The OnStar app also told more than 370,000 enrolled drivers they were not enrolled in Smart Driver. The department said GM later unenrolled them without disclosing the mistake, leaving their data with the brokers and insurers.

The settlement also requires GM to limit the driving data it collects, undergo internal and external privacy program assessments and accept oversight and training requirements at its dealerships. Under the final consent decree, GM must pay the $220 million within 30 days of the decree's Nov. 30 effective date. Within 60 days, it must develop dealer training materials telling dealership staff to let customers review the privacy disclosures and accept them themselves before enrolling in OnStar.