Vermont to receive $4.5M settlement from General Motors following data privacy investigation

Theo Wells-Spackman is a Report for America corps member who reports for VTDigger.

MONTPELIER — Roughly two years ago, Vermont Attorney General Charity Clark and James Layman, who leads Clark’s consumer protection unit, read a New York Times journalist’s coverage of worrying data sharing practices at car manufacturing giant General Motors.

The account, which laid bare the auto maker’s practice of sharing data about customers’ driving habits — such as seat belt use and speeds — with insurance companies, led the Vermont officials to initiate what became a joint effort between 35 states and the District of Columbia to investigate the company’s handling of consumer information. The resulting $220 million nationwide settlement leaves the state with a $4.5 million payout and a host of new privacy guarantees from General Motors, according to Clark.

At a press conference Thursday, Clark said the investigation found the company’s use of data had clear impacts in Vermont between 2016 and 2024, allegedly violating the state’s Consumer Protection Act through unfair or deceptive practices.

“GM collected data from tens of thousands of Vermonters and sold that data to insurance companies and data brokers without obtaining consent from drivers,” she said. Auto insurers, she added, then “charged some drivers higher rates based on the data.”

The settlement, which was reached before the multistate coalition formally filed a lawsuit, expressly states that the company does not admit to having broken any law.

A spokesperson for General Motors told VTDigger that the company had discontinued its “Smart Driver” program in 2024 in an emailed statement Thursday, and added that the company had already taken steps to strengthen its privacy practices. 

“GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” the spokesperson said.

The practices in question related to data collected by a digital program offered by General Motors that tracks drivers’ behavior to promote safer driving. Clark said the company failed to be transparent about where that data was shared, and to ensure that buyers were able to give informed consent before opting into the program.

“Not only did consumers not know that their data would be used this way, many consumers reported that they didn’t even know they were enrolled in the ‘Smart Driver’ program to begin with,” she said.

Settlement terms laid out in a Thursday court filing include standards for customer consent General Motors must abide by, and place limits on the collection of driver data, among other agreements.

The company has recently faced scrutiny on several other related fronts: The Federal Trade Commission issued an order in January restricting the company’s data-sharing practices, and a class-action lawsuit leveling similar charges against the company by customers is ongoing.

The payout announced Thursday will ultimately rest in the state’s General Fund, which is controlled by the Legislature, Clark said. Because of Vermont’s work at the very outset of the investigation, the state is receiving substantially more money than it would ordinarily have been allocated based on population, she added.

Data privacy has been a hot-button issue among Vermont lawmakers in recent years, and Gov. Phil Scott signed into law a bill designed to help secure residents’ control over their personal information earlier this year. Clark said she was grateful for a number of the bill’s protections but was concerned that it limited individual Vermonters’ ability to sue companies on their own.

Clark, who also recently announced a large settlement with tech giant Meta, said her focus on consumer protection in relation to data privacy and the internet would continue. She recently requested that lawmakers fund a new staff position in her office to focus on large tech companies, she said.

“The internet is paid for with our data,” Clark said. “We have to always be mindful of ways that we need to be enforcing the law, and protecting people.”

Read the story on VTDigger here: Vermont to receive $4.5M settlement from General Motors following data privacy investigation.