Ohio joined 34 other states and Washington, D.C. in suing General Motors over allegations that it collected and sold drivers' data without permission.
The allegations stem from the Smart Driver program, which it initially marketed as a way for drivers to monitor their driving behavior. The Smart Driver program was operated by General Motors subsidiary OnStar, and allowed drivers to check their own data through a smartphone app.
In 2024, the New York Times revealed that General Motors had been sending driver behavior data to LexisNexis, without consumers' permission. LexisNexis would send reports based on this data to insurance companies, who would then adjust premium costs or even deny coverage based on an individual's data. General Motors discontinued the Smart Driver product in 2024.
According to a statement from Ohio Attorney General Andy Wilson, the OnStar app told 380,000 drivers that they were not enrolled in the data collection program, even though they were.
"GM broke consumers trust by selling such data without their knowledge and consent," Ohio Attorney General Andy Wilson said in a statement. "Ohioans should not have to worry that the information collected by their own vehicles will be used against them. Companies must be held accountable when they put profits ahead of consumers' privacy."
Wilson was part of a coalition of attorneys general nationwide, who sued General Motors. In late October, attorneys announced that General Motors would pay $220 million to settle the case. Ohio will receive about $8 million from the settlement.
In addition, General Motors has agreed to limit and protect the driving data it collects. The settlement mandates third-party data protection assessments. Earlier this year, the FTC imposed a five year ban on General Motors disclosing driver location and behavior data to consumer reporting agencies. It also required General Motors obtain affirmative express consent from consumers before collecting or using data, and making it easier for consumers to opt out of data collection and delete collected data.