GM will pay $220 million over claims it sold driving records that reached insurers. It may have logged hard stops, fast starts, driving above a set speed and late-night trips.
If you drove a Chevrolet, GMC, Buick or Cadillac with OnStar any time from the mid-2010s to 2024, your car may have been keeping score on you. It may have logged hard stops, fast starts, driving above a set speed and late-night trips.
According to 36 attorneys general, including Vermont’s, General Motors sold those driving records to data brokers, companies that buy and resell information about people. The brokers turned the records into reports and sold them to car insurers, which could use them to set your rate. Many drivers never knew they had been signed up, the states say. GM’s own app told more than 370,000 of them they weren’t.
GM agreed Thursday to pay $220 million to settle the claims, without admitting any of them. In a statement to Reuters, the company said the settlement reinforces steps it has already taken to strengthen privacy. Tens of thousands of Vermonters were enrolled, according to the Vermont attorney general’s office.
Vermont gets $4.54 million. The settlement provides no payments to drivers, and it doesn’t identify which Vermont drivers paid higher premiums or calculate their losses.
Could This Have Happened to Me?
OnStar is GM’s built-in service for crash response, roadside help and remote unlocking. Smart Driver was an OnStar feature that GM launched in 2015 to give drivers feedback and tips on their driving, according to the state’s complaint. GM shut it down in April 2024, a month after The New York Times reported that carmakers were sharing driving records with insurers.
The states describe three ways drivers ended up enrolled without understanding what they had agreed to:
- At the dealership. Most enrollments happened before buyers left the lot. GM paid dealership employees bonuses tied to sign-ups, and in many cases those employees allegedly clicked “accept” for customers.
- Through the fine print. GM’s sign-up screens pitched Smart Driver as a way to become a better driver. The privacy statement said drivers would be asked again before their information went to a usage-based insurance program, meaning insurance priced on how you actually drive. But GM sold the identifiable driving records of every Smart Driver customer, whether or not they signed up for GM’s separate insurance discount program, the states allege.
- Through a glitch. GM later unenrolled the drivers its app had wrongly told weren’t enrolled, without telling them their driving records had already been sold.
Separately, starting in 2018, GM recorded the precise location of millions of vehicles every three seconds, from the moment the car started until it was shut off. GM licensed that location data to two other companies, which could pass it on to others with GM’s approval, the complaint says.
Did It Affect My Insurance?
According to the complaint, the driving records traveled like this:
- Your car recorded hard braking, fast starts, hard turns, times you went over a set speed, late-night driving, and the start and end time of each trip.
- GM sold those driving records, tied to your car’s vehicle identification number, to LexisNexis Risk Solutions and Verisk Analytics.
- LexisNexis and Verisk turned the driving records into driver scores and reports and sold them to insurers.
- Some insurers used those reports, in part, to set rates.
GM made more than $20 million nationwide from the sales, the complaint says.
The court filings don’t show which insurers used the reports, which Vermonters’ rates changed, or by how much. The Times documented drivers whose premiums went up after their insurers got the reports. To find out whether your own driving records were in the file, you can ask LexisNexis and Verisk. The box below explains how.
Verisk says it stopped receiving GM driving records on March 18, 2024, and no longer sells driving reports to insurers. A separate Federal Trade Commission order bars GM for five years from sharing driving or location data with consumer reporting agencies. Those are companies like LexisNexis and Verisk that compile reports on people and sell them, the way credit bureaus do.
Why the State Gets the Money and Drivers Don’t
Vermont’s consumer protection law lets the attorney general ask a court to order a company to pay consumers back. Vermont’s complaint, which the attorney general’s office released with the settlement, asked for exactly that. The settlement instead directs $4.54 million to the state and sets up no compensation program for drivers. The agreement doesn’t explain why individual payments were left out, and it sets up no claims process for reimbursing what drivers may have paid.
So the settlement both protects Vermonters and doesn’t:
- What drivers get: new rules GM has to follow, listed below. The rules cover personal vehicles, not business, fleet, rental or government vehicles. They don’t depend on proving you were overcharged. Most take effect Nov. 30, 2026.
- What drivers don’t get: any payment from the settlement for what a GM report may have cost them.
- What drivers keep: the right to sue GM on their own. The settlement doesn’t take that away.
Where the $4.54 million goes. The agreement lets the state spend it on the cost of the investigation and lawsuit, future consumer protection and privacy enforcement, consumer education, or any other use state law allows. It doesn’t say how the money will be divided among those uses.
How big the payment is. The states say GM made more than $20 million nationwide selling the driving records. The settlement totals $220 million. Vermont’s share comes to about $7 for every Vermonter. It’s about 2% of the total, even though Vermonters are about 0.2% of the U.S. population.
The attorney general’s office credits Vermont’s role as one of the first states to investigate. Washington and Oregon led the case, and Vermont sat on the executive committee that assisted them. Colorado, also on that committee and with about nine times as many people, gets about $7.2 million.
What Changes for GM Drivers
Most of these rules take effect Nov. 30, 2026. Some come later: the new-car sign-up and dealer-training rules within 60 days, and the deletion of older driving records within 180 days. GM must:
- Get your clear, separate OK before collecting your driving or location data or sharing it with anyone else. Accepting a general terms-of-service agreement, a pre-checked box or saying nothing doesn’t count. Exceptions include emergency responders, crash and safety alerts, recalls, warranty work and court orders.
- Tell you before you agree if your driving data could be used to set insurance rates.
- Let you turn off location collection on the vehicle, if your car is equipped to do that.
- Let you shut off all remote data collection if you decline or cancel OnStar. GM can still collect what it needs for safety issues and software updates.
- Have new-car buyers sign up for OnStar themselves. If a buyer doesn’t respond within 10 days, GM must treat it as a no.
- Train dealers that the customer, not the salesperson, has to accept the privacy terms.
- Send you a copy of your driving data, and a list of the kinds of companies it went to, within 45 days of your request. GM must also let you request deletion.
- Delete driving data it kept from before Jan. 16, 2025, by about the end of May 2027. There are exceptions for lawsuits, recalls and safety research.
- Ask the companies it sold driving data to before 2025 to delete it.
Most of these rules stay in force until 2046.
Only GM Is Covered, for Now
The settlement binds GM only. Verisk says it also received driving records from Honda and Hyundai until April 2024.
Vermont passed its own privacy law this year. Gov. Phil Scott signed the Vermont Data Privacy and Online Surveillance Act in June, and it treats precise location as sensitive data. It takes effect Jan. 1, 2028. Until then, the main Vermont law covering other carmakers is its general consumer protection law, which bars unfair or deceptive business practices.
Check Your Own Driving Records
Here’s what you can find out and what you can change. What you do with your own data is your call.
- See what LexisNexis has. Request your free consumer disclosure report at consumer.risk.lexisnexis.com/consumer. If LexisNexis still holds driving records on you, they’ll be in it.
- See what Verisk has. At fcra.verisk.com, choose the Driving Behavior Data form. You can email it to FCRA-NPC@verisk.com, fax it to 800-955-2422 or mail it. Verisk gives one free report every 12 months. It has driving records only from GM, Honda and Hyundai vehicles.
- Dispute errors. Under the federal Fair Credit Reporting Act, you can dispute anything inaccurate in either report, and the company has to reinvestigate.
- Ask your insurer. If an insurer raised your rate or turned you down because of a report like these, federal law requires it to tell you and to name the company that supplied the report.
- Ask GM for a copy of your data, or to delete it. Call 1-866-MYPRIVACY (1-866-697-7482) or use GM’s U.S. Consumer Privacy Request Form.
- Watch for a GM email by about Feb. 28, 2027. GM may email you asking permission to keep driving records it collected before 2025. If you say no, or don’t answer within 30 days, GM must delete them. Make sure any such email really comes from GM before you click anything.
- Stop the collection. GM must offer a way to turn off location collection on vehicles that can do it. If you decline or cancel OnStar, GM must let you shut off remote data collection. Check your vehicle’s settings or ask GM.