Blog Data Privacy
GM's $220 Million Driver Data Settlement: Lessons on Consent
On this page· 8 sections
General Motors has agreed to pay $220 million to resolve claims from a coalition of 36 attorneys general in the United States. The carmaker was accused of selling driver data, including location and driving behavior, to data brokers that passed it on to insurers. The GM driver data settlement is a clear case study in how not to ask for consent.
What the $220 million settlement covers
The settlement was announced on October 29, 2026. According to a press release from the Pennsylvania Attorney General, Washington and Oregon co-led the case, an executive committee of ten other states assisted, and more than twenty further attorneys general joined, including the District of Columbia. Pennsylvania expects to receive $8.67 million.
The payment is only part of the deal. GM must obtain affirmative express consent from consumers before collecting or disclosing driving and location data. It must limit the driving data it collects and run a comprehensive data privacy program with internal and external assessments. TechCrunch reported that a third party will assess GM’s compliance with that program.
Another obligation targets dealerships. GM must increase oversight and training for dealership staff so that customers are not enrolled in data collection without approval. The attorneys general described the terms as significantly stronger than any earlier resolution with GM over the same conduct.
The Smart Driver program and the data it shared
At the center of the case is Smart Driver, a free feature in GM’s connected car apps. A connected car sends data to the manufacturer’s servers over a cellular link, which lets owners use navigation, emergency assistance, and trip reports from an app. GM marketed Smart Driver as a way to help people drive more safely.
The complaint says GM enrolled millions of drivers in the program from 2016 to 2024. The data included the number of trips, the start and end time of each drive, hard braking and rapid acceleration events, and speeding above the limit. TechCrunch added that the program also tracked precise geolocation and seat belt use.
The issue was GM’s promise. The attorneys general say GM told drivers it would not share their data with insurers without express consent. Instead, the data was sold to data brokers, and the brokers’ contracts with GM stated that it would be used for insurance products. Citing The New York Times, TechCrunch named the brokers as LexisNexis and Verisk. Insurers then used the data, in part, to set rates.
“This bait-and-switch tactic betrayed consumers’ trust and potentially impacted their insurance rates,” said Pennsylvania Attorney General Dave Sunday. GM ended Smart Driver in 2024 after The New York Times reported on the practice.
Enrollment at the dealership
The Record detailed further allegations. Most customers were allegedly enrolled at dealerships during the purchase, often under pressure. Dealership employees allegedly received bonuses, and dealerships were ranked against each other by enrollment numbers. A single sign-up also enrolled drivers in OnStar services.
The complaint also alleges that GM told more than 370,000 customers their data was not being monitored because they were not enrolled. GM later unenrolled them without disclosing the error, and data already collected was not retrieved from brokers or insurers. These remain allegations in the complaint.
GM’s response and the cases still open
In an emailed statement quoted by TechCrunch and The Record, GM said the agreement addresses Smart Driver, a product it ended in 2024. GM says it will no longer sell vehicle information that can be linked to an individual, their location, or how they drive. It may still share anonymized data that is not tied to individuals with certain partners. GM has also updated its privacy policy and launched a consumer Privacy Center.
The settlement follows action by the Federal Trade Commission. On January 14, 2026, the FTC finalized a 20-year order against GM and OnStar. The order bars GM from disclosing geolocation and driver behavior data to consumer reporting agencies for five years. GM must also give U.S. consumers a way to request a copy of their data and ask for its deletion, and let them turn off precise geolocation collection.
The matter is not fully closed. Texas Attorney General Ken Paxton filed a similar lawsuit in 2024, which The Record says is ongoing. Texas is seeking a jury trial, civil penalties of up to $10,000 per violation, and a court order requiring GM to delete the data it collected.
How this maps to Indonesia’s data protection rules
In Indonesia, personal data processing falls under Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law No. 27 of 2022 on Personal Data Protection, or UU PDP). Its implementing regulation, Peraturan Pemerintah Nomor 33 Tahun 2026 (Government Regulation No. 33 of 2026), sets out what valid consent looks like. Several of its provisions speak directly to the GM case.
According to a summary by Bisnis.com, Article 32(2) of the regulation requires explicit consent to be freely given, informed, specific, and unambiguous. The explanatory notes cite an example of ambiguous consent: bundling consent to data processing with acceptance of terms and conditions. The one-step dealership sign-up alleged in the GM case closely resembles that example.
Other provisions summarized by Bisnis.com:
- Consumers who decline consent must still receive the goods or services without a drop in quality, unless the service genuinely requires that processing (Article 35(1)).
- Data controllers must be able to show proof of consent as part of their accountability (Article 36).
- When consent is withdrawn, processing must stop within 3×24 hours after the request is verified (Article 92(1)).
On penalties, Bisnis.com reported that Article 185 of PP 33/2026 caps administrative fines at 2% of annual revenue. The amount depends on factors such as the harm caused, how long the violation lasted, the type and number of affected data subjects, and compliance history.
What this means for lenders, insurers, and fleet operators
Connected-device data is already common in Indonesia. Vehicle financing companies install GPS trackers, logistics fleets monitor routes and driver behavior, and vehicle app providers send trip reports to owners’ phones. That data is valuable for credit and insurance risk assessment, which is exactly why the temptation to share it is strong.
If your organization handles this kind of data, these steps are worth reviewing:
- Map the data flow. Record what each device sends, how often, where it is stored, and who receives it, including partners and vendors. Teams building Internet of Things solutions should be involved early, since they decide what the device transmits.
- Separate consent by purpose. Consent to a safety feature is different from consent to share data with an insurer or another partner. Keep it apart from the terms and conditions.
- Supervise the point of enrollment. Dealers, agents, and sales staff are often where consent is collected. Give them clear scripts and training, and avoid incentives that reward sign-ups without explanation.
- Keep records and offer a way out. Log when consent was given and for what purpose, and provide a withdrawal option that actually stops data flowing to every recipient.
For banks, lenders, and insurers, the key question is where purchased data comes from. Third-party data obtained without valid consent can expose the buyer to legal and reputational risk. Teams working on digital financial services should ask every data supplier for evidence of a lawful basis before using the data for pricing or eligibility decisions.
The same consent principles apply to devices that record other people, such as AI-powered cameras or voice recorders. We covered that topic in our piece on the Bee Frontier and Eclipse AI recorders.
Frequently asked questions
Does the settlement affect drivers in Indonesia?
The settlement resolves claims brought in the United States. The sources we reviewed do not mention Smart Driver or similar data sales in Indonesia. For Indonesian organizations, the case is mainly a lesson in how to request consent and manage vehicle data.
What data did the Smart Driver program collect?
According to the attorneys general, it covered the number of trips, start and end times, hard braking, rapid acceleration, and speeding above the limit. TechCrunch added precise geolocation and seat belt use.
Can a company in Indonesia share customers’ location data with partners?
Sharing personal data requires a lawful basis under the UU PDP, one of which is explicit consent for a specific purpose. That consent must be specific, must not be bundled with terms and conditions, and the company must be able to prove it. For real cases, consult a legal adviser.
Conclusion
The GM case shows that privacy failures often start at points that seem minor: a single checkbox at a dealership and a single contract with a data partner. Organizations that collect data from vehicles, phones, or sensors can avoid the same outcome by designing consent that is separate, documented, and easy to withdraw from the start. If you are building a service around connected devices, the Merakit team can help design its data flows and consent process.
Sources
- Attorney General Sunday Secures $220 Million National Settlement over Allegations that General Motors Shared Drivers’ Private Data, Pennsylvania Office of Attorney General, October 29, 2026
- GM reaches $220M settlement over selling drivers’ private data, TechCrunch, October 29, 2026
- GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms, The Record, October 29, 2026
- FTC final order against General Motors and OnStar, Federal Trade Commission, January 14, 2026
- Aturan Turunan UU PDP: Persetujuan Data Konsumen Lebih Ketat, Bisnis.com, August 29, 2026
- UU PDP: Perusahaan Pelanggar Bisa Didenda 2% dari Pendapatan, Ini Mekanismenya, Bisnis.com, September 1, 2026
