SALT LAKE CITY — Utah will receive nearly $7 million as part of a $220 million multistate settlement with General Motors over allegations that the automaker collected and sold drivers’ personal driving information and location data without their consent.
Utah Attorney General Derek Brown and the Utah Department of Commerce’s Division of Consumer Protection announced the settlement, which involves 35 other state attorneys general and establishes new restrictions on how GM collects and shares driver information.
The settlement could affect GM vehicle owners throughout Utah, including those in Cache Valley and northern Utah, whose driving habits and location information may have been collected through the company’s Smart Driver program.
According to state investigators, GM sold detailed driving data to third-party brokers, which then provided the information to insurance companies. Insurers used the data, in part, to determine insurance rates, sometimes resulting in higher premiums for drivers.
“Your driving data tells the story of your life: your commute, your errands, the route to your kids’ school, even the time you get home at night. That story belongs to you,” Brown said. “Drivers should never have to wonder whether that information is being collected or passed along without their knowledge.”
GM’s Smart Driver program operated from 2016 to 2024, collecting information about driving behavior, including vehicle location, trip frequency, starting and ending times, speeding, hard braking and rapid acceleration.
The states allege GM promoted the program as a tool to help motorists improve their driving habits while assuring customers their information would not be shared with insurance companies without permission.
Instead, investigators say GM sold the information to data brokers under agreements specifying that it would be used for insurance-related products.
Many drivers were enrolled in Smart Driver at dealerships through the same registration process used to activate GM’s OnStar services. Investigators found that dealership employees sometimes accepted terms on behalf of customers without their knowledge or consent.
GM also provided bonuses to dealership employees based partly on enrollment numbers, according to the states.
Investigators identified additional problems with GM’s notification systems. More than 370,000 drivers were incorrectly informed through the OnStar app that they were not enrolled in Smart Driver, even though their information was being collected and sold.
GM subsequently removed those drivers from the program without notifying them of the error. Their previously collected information remained with data brokers and insurance companies.
“Utahns deserve clear information about how their sensitive data will be used before they sign, and the ability to opt out,” said Utah Department of Commerce Commissioner Margaret Woolley Busse. “Misrepresenting this data use is a significant breach of trust that cannot be overlooked. It’s wrong to obscure this or bypass their consent for profit or personal gain.”
The allegations gained national attention in March 2024 when The New York Times reported that insurance companies were using GM driving data to adjust customer premiums. GM discontinued its Smart Driver program following the report.
Under the settlement, GM must obtain drivers’ affirmative, express consent before collecting or sharing their driving behavior and location information.
The agreement also requires the automaker to limit the driving data it collects, establish a comprehensive privacy program with internal and external assessments, and improve training and oversight of dealership employees responsible for obtaining customer consent.
Utah’s share of the settlement totals $6,938,619.
Washington and Oregon led the multistate investigation, with Utah serving on the executive committee alongside nine other states.
Idaho was also among the states participating in the settlement.
The agreement is intended to strengthen consumer privacy protections and prevent automakers from sharing sensitive driving information without customers’ knowledge or authorization.