Burlington and Vermont to receive $4.5M from GM data settlement

General Motors will pay a total of $220 million to settle claims that the company sold private driver data to third parties without consent. Vermont Attorney General Charity Clark announced the agreement on Wednesday alongside a bipartisan group of 35 other state attorneys general. Vermont is set to receive $4.54 million of the total payout due to its early role in the investigation.

The dispute centers on GM's Smart Driver program, which ran from 2016 to 2024. During that period, the company enrolled millions of drivers, including tens of thousands in Vermont, in a system that tracked driving habits. GM marketed the tool as a way to improve safety and told drivers that their data would not be shared with insurers without express permission. Tens of thousands of local residents were part of this enrolled group.

Investigators found that GM sold this data to brokers under contracts specifying the information was for insurance products. The brokers then passed the data to insurance companies. These insurers used the details to adjust premiums based on driving behavior. GM did not inform drivers that their data was being used for this purpose.

Most enrollments happened at car dealerships. Sales employees received bonuses for signing up customers for GM's OnStar services, which were bundled with Smart Driver. In many cases, dealership staff accepted the terms and conditions on behalf of customers without asking for consent. GM's systems also failed to notify drivers of their status. The OnStar app incorrectly told over 370,000 drivers that they were not enrolled in Smart Driver. GM later unenrolled these drivers quietly and left their data with brokers and insurers.

The data sold was specific and identifiable. It included the number of times a person drove, the start and end times of each trip, the frequency of hard braking or acceleration, and instances of speeding. Insurance companies used this information to change rates, sometimes increasing premiums. GM ended the Smart Driver program after reports in The New York Times detailed these practices.

Under the settlement, GM must obtain affirmative express consent from consumers before collecting or disclosing driving and location data. The company must also limit the amount of driving data it collects and protect personal information through a comprehensive data privacy program. The agreement includes requirements for internal and external assessments of data protection programs.

GM also agreed to provide oversight and training at its dealerships. This is intended to protect consumers from being enrolled in data collection schemes without their consent. The terms of this settlement are stronger than previous resolutions reached with GM regarding this conduct.