GM’s $220 million settlement puts a price on driver consent

General Motors agreed on 29 October to pay $220 million to 36 US states to settle claims  that it sold drivers’ location and driving behaviour data to brokers, who resold it to insurers.

The data came from Smart Driver, a free feature in GM’s connected car apps that scored braking, speeding and seatbelt use. The scores reached LexisNexis and Verisk, and from there insurers’ pricing. GM closed the programme in 2024 after a New York Times investigation that led to an FTC order.

The money is not the point. GM must now get express consent before it collects or shares driving data, and submit to third-party audits of its privacy programme. That builds on a January FTC order that already bars GM, for five years, from passing driving data to consumer reporting agencies, the brokers that feed insurers. GM says it will no longer sell data that can be tied to an individual.

Rivals have taken note. Four days later, Ford launched a “Privacy Promise” website showing owners how to switch off data sharing in the car or the Ford app, and pledged never to sell driving data to brokers or insurers. Opting out has a cost: features such as BlueCruise hands-free driving and remote vehicle location stop working. Ford’s own survey of 1,000 consumers found that 56% value their privacy but would share some data in exchange for useful features. That chimes with our survey of 1,500 US policyholders, in which two-thirds of drivers without a UBI policy said they would share their data for a discount.

A pattern, not a one-off

GM is not alone. In March, a US judge let a class action against Allstate and its data arm Arity proceed. It alleges Arity’s software, embedded in apps such as Life360 and GasBuddy, tracked 45 million drivers. Allstate’s defence was that its own and the apps’ privacy policies disclosed the collection.

That defence failed spectacularly for Meta. On 21 October, a New Mexico judge ordered it to pay $25 billion over the Cambridge Analytica affair, ruling that Facebook had told users they controlled their data when they did not. Meta will appeal. But the warning reaches both the apps that promise users control and the companies buying what they collect.

The end of the shortcut

US insurers have had two routes to driving data. One is opt-in telematics, where drivers knowingly trade data for a discount. The other ran in the background: car makers and apps collected data, and brokers sold it on as scores.

The second route scaled because drivers were never asked whether their data could be used to price their insurance. This is possible in the US due to a more lenient privacy regulatory framework (except in California). Regulators are now closing it, and car makers are walking away from it. Insurers will collect data from fewer drivers, but data they can defend.

Europe got there first

European insurers have long envied the scale of the US market. Under GDPR, a GM-style background resale was never really an option. The EU Data Act now lets drivers direct their vehicle data to an insurer of their choice, and since September new connected cars must be built to allow it.

The US is converging on the same principle: the driver decides. The winners will not be those with the most data, but those drivers trust enough to share it.

In our UBI Global Study, we analysed the connected insurance strategies of 29 insurers and car makers  including GM, Ford and Tesla. If you’d like to discuss what it means for your business, contact Alex Tallon at [email protected]

Article written by Alex Tallon, under PTOLEMUS copyright

PTOLEMUS intellectual property. Feel free to use it by quoting PTOLEMUS Consulting Group as the source.