According to Ars Technica, GM will pay $220 million after selling Smart Driver data. The case shows that consent buried in a car’s sign-up flow does not protect drivers. Driving data needs clearer rules.
Key takeaways
- Ars Technica reports that General Motors is to pay $220 million after customer Smart Driver data was sold, and that the data reached insurance companies.
- Drivers often discovered that their driving behaviour had been shared only after it had already reached insurers, not when they agreed to anything.
- Telematics data on braking, acceleration and the time of day someone drives can be used to price insurance, so how it is shared has direct financial consequences.
- A large payment can deter carmakers, but it does not change by itself how consent for vehicle data is asked for or recorded.
The argument: consent for driving data has failed in practice
Modern cars are connected devices. They hold mobile network connections, record how they are driven and send that information back to the manufacturer. Smart Driver was a GM feature built on that capability. It gave owners feedback on habits such as hard braking, rapid acceleration and late-night driving. In principle it was a coaching tool for the driver.
Ars Technica reports that the data did not stay with the driver. It was sold, and it ended up with insurance companies. GM is now to pay $220 million over the matter. The summary available here does not say whether that sum is a court-approved settlement, a regulatory penalty, or a combination. It also does not say how the money will be divided or who qualifies. Those details are not known from the source material and should not be assumed.
The argument of this article is simple. If owners of a car can find that their driving behaviour has been passed to insurers without understanding that this would happen, then the consent model the industry relies on is not working. Box-ticking during vehicle setup or at a dealership is not the same as informed agreement. The size of the payment suggests that this is not a minor technical lapse. It is a structural problem with how vehicle data is collected and monetised.
That does not mean every telematics programme is harmful. Some drivers deliberately sign up to usage-based insurance, knowing that their driving will be monitored in exchange for a possible discount. The difference is knowledge and choice. When a driver knowingly installs an insurer’s app or plugs in a device, the trade is visible. When the same type of data flows from the car maker to the insurance market in the background, the driver cannot weigh the trade at all.
Evidence: drivers learned about the sharing after the fact
The way the issue came to light is the first piece of evidence. Ars Technica says owners of GM cars found that their driving data had been sold to insurers. That wording matters. Drivers came across the sharing after it had already taken place. They did not decide it in advance.
In a functioning consent model, the moment of discovery and the moment of agreement are the same: the person is told what will happen and says yes or no. When the discovery comes later, usually because something unexpected has happened, consent has been separated from understanding. Whatever legal text existed at the time, the people affected did not experience it as a choice they had made.
This pattern is common across digital services, but it is sharper with cars. Vehicle setup often happens at a dealership, under time pressure, alongside financing paperwork and the handover of keys. Connected services may be activated as part of that process, sometimes by staff rather than by the owner. Privacy terms presented in that setting are unlikely to be read closely. A data practice that depends on drivers parsing those terms is likely to produce exactly the kind of surprise described in the reporting.
Evidence: driving data is unusually consequential
The second piece of evidence is the nature of the data. Information about how hard someone brakes, how fast they accelerate, how far they drive and when they drive can be read as a proxy for risk. That is why insurers value it. A profile suggesting frequent late-night trips or abrupt braking can be interpreted as risky driving, whether or not the driver was actually at fault.
The difficulty is that raw telematics does not capture context. A hard stop may reflect another road user’s mistake. Driving at night may reflect shift work rather than recklessness. A driver who has no idea that this data is being shared also has no chance to explain it or dispute it. The data travels on its own, stripped of the circumstances that produced it.
When data like this feeds into insurance pricing, the effect on the person is financial and ongoing. It is not a one-off exposure such as a leaked email address. It can shape what someone pays to stay insured, possibly for years. The scale of the payment reported by Ars Technica reflects, at least in part, how seriously this kind of use is taken. Exactly how the figure was calculated is not known from the available summary.
Evidence: the commercial incentive points the wrong way
The third piece of evidence is structural. Car makers have spent heavily on connected services, and vehicle data is one of the few assets from those services that can be sold on repeatedly. Insurers and intermediaries who build risk scores have a clear interest in buying it. Neither side of that transaction has the driver’s interests at its centre.
When the commercial incentive favours sharing and the consent process is weak, the default drifts towards more data leaving the car. The GM case, as reported, is an example of that drift reaching its logical end: a feature presented to drivers as helpful feedback became a source of data for the insurance market. In the United States, regulators including the Federal Trade Commission have already treated GM’s handling of driving data as a consumer protection issue. That shows the concern goes beyond a single lawsuit.
A large payment changes the calculation for that one company. It does not automatically change the incentives for the rest of the industry, and it does not set out what proper consent should look like. That is why the case points towards a need for clearer rules rather than case-by-case penalties alone.
The case against: consent may have existed, and payments are not admissions
The strongest counter-argument deserves a fair hearing. First, a payment of this kind is not necessarily an admission of wrongdoing. Companies often settle disputes to limit legal costs and uncertainty, and settlement terms frequently state that no liability is accepted. The summary available here does not say whether GM admitted fault. Treating the $220 million as proof that the company acted unlawfully goes beyond what is known.
Second, it is possible that drivers did agree to terms that allowed sharing, even if they did not read or understand them. On this view, the problem is not that consent was absent but that people did not engage with it. That is a problem common to almost every digital service, and singling out car makers may be unfair. Better design might help, but the legal basis for the sharing may have been sound.
Third, telematics data can benefit drivers. Careful drivers may get lower premiums when insurers can see how they actually drive, rather than relying on broad categories such as age or postcode. Restricting the flow of driving data too tightly could take that option away and push insurers back towards cruder pricing methods that penalise people for factors they cannot control.
Fourth, a single case, however large, does not show that consent is failing across the industry. Other manufacturers may handle data quite differently. Generalising from one company’s experience risks overstating a problem that may be limited to particular programmes or practices.
These are serious points. They suggest that the conclusion should be framed with care: the GM case shows that this consent model failed for these drivers, and that the risk of similar failures elsewhere is real. It does not prove that every data-sharing arrangement in the car industry is improper.
Evidence that would change the conclusion
Several kinds of evidence would weaken or overturn the argument made here. If the final terms of the GM matter showed that most affected drivers had actively and knowingly opted in to having their data shared with insurers, the case would look less like a failure of consent and more like a dispute over its scope.
Equally, if independent reviews of other car makers’ connected services found clear, separate and easily reversible consent for sharing data with third parties, that would suggest the industry can get this right and that the GM case is an outlier. Studies showing that drivers understand and value telematics-based pricing, when it is offered openly, would also support the view that the data flow is not inherently a problem.
In the other direction, evidence that similar sharing is widespread among car makers, or that drivers’ insurance costs rose as a result of data they did not know was being shared, would strengthen the case for firmer rules. Clear guidance or legislation that defines what valid consent for vehicle data looks like would provide a benchmark against which cases like this one could be judged. At present, many of the specifics of the GM payment, including its legal form and who will receive it, are not known from the source material. Those details will matter in judging how far the case can be generalised.
Sources and further reading
- Ars Technica, reporting on GM’s $220 million payment over Smart Driver data
- US Federal Trade Commission, published material on consumer data and connected vehicles
- Consumer protection and privacy advocacy groups, analyses of telematics and insurance pricing
- Insurance industry trade publications, explainers on usage-based insurance
Surfaced from the rss:arstechnica signal “carmaker driving data payout”. AI-assisted draft, editorially reviewed.
