General Motors (GM) reached a $220 million settlement, equivalent to approximately R$ 1.2 billion, with 35 American states and the District of Columbia. This agreement was announced on Thursday (29) to finalize allegations that the automaker provided drivers' location and driving data without proper permission.
GM stated that it does not admit any fault in this process. The amount paid represents eleven times the value the company would have gained from commercializing this data, according to an estimate by the California Attorney General.
The issue originated with Smart Driver, a free feature offered by OnStar, GM's connected services system. This feature aimed to help customers drive more safely and enable insurance discounts. The system assigned a score to the driver based on factors such as sudden braking, vigorous acceleration, and stretches driven over 129 km/h.
However, this data was sent to the companies LexisNexis and Verisk, which are responsible for compiling consumer reports, functioning like a 'traffic Serasa'. These entities, in turn, resold this information to insurance companies, resulting in increased insurance premiums for some customers without them knowing they were being monitored.
Prosecutors alleged that many individuals were included in the program through dealership salespeople, who received bonuses for each subscription. Furthermore, the OnStar app mistakenly notified over 370,000 drivers that they were not participating in Smart Driver, even though data collection continued.
GM discontinued the program in 2024. As part of the agreement, the company must ensure explicit authorization is obtained before collecting or sharing such data, submit to external audits, and revise the training provided at dealerships, thereby preventing any pressure on customers to subscribe to the service.
The automaker argues that the agreement pertains to a product that has already been terminated and serves to reinforce the privacy protection measures it was already implementing. It is important to note that OnStar is also present in Chevrolet vehicles sold in Brazil since 2015, but the litigation in question involves exclusively American customers.
In the Brazilian context, this type of data collection must comply with the General Data Protection Law (LGPD), which requires unequivocal consent for sharing personal information. The National Data Protection Authority (ANPD) has the authority to impose fines of up to 2% of the company's revenue in the country, with a ceiling of R$ 50 million per infraction; the agreement signed by GM exceeds this established limit by more than twenty times.
GM is not the only one under scrutiny. In the United States, a Toyota RAV4 owner filed a lawsuit against the brand after discovering, during an insurance quote, that the insurer possessed detailed records of their driving habits. Toyota maintains that the customer accepted the terms of the connected services, and the case was sent to arbitration, a form of private judgment.
