Penalty Amount
$220,000,000
Consumers Affected
370,000
General Motors agreed to a nationwide $220 million settlement over allegations that it sold drivers’ identifiable driving behavior and location data to data brokers, which then sold it to insurers. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
General Motors will pay $220 million and must obtain affirmative express consent before collecting or disclosing covered driving and location data, limit the driving data it collects, and maintain a comprehensive privacy program. The settlement also requires internal and external privacy assessments, dealership oversight, and training.
Review vendor and data-processing agreements with telematics providers, data brokers, and analytics partners for explicit limits on collecting, disclosing, reselling, and using connected-vehicle driving and location data, including prohibitions on insurance underwriting or rate-setting unless consumers have provided valid affirmative express consent. Check customer-facing privacy notices and consent flows to ensure disclosures match actual data practices and that dealerships or other agents cannot enroll customers or accept terms on their behalf without authorization. Update vendor audit, assessment, oversight, and training obligations, and review customer and dealership agreements for clear responsibility for consent records and accurate enrollment communications.
Entity
General Motors
Industry
AutomotiveOfficial Press Release
https://coag.gov/press-releases/general-motors-will-pay-220m-for-illegally-sharing-drivers-private-data/
2026.10.29 Denver District Court GM Complaint CO
https://coag.gov/app/uploads/2026/10/2026.10.29-Denver-District-Court-GM-Complaint-CO.pdf
2026.10.29 GM Consent Judgment CO
https://coag.gov/app/uploads/2026/10/2026.10.29-GM-Consent-Judgment-CO.pdf
Colorado Attorney General Enforcement Page
https://coag.gov/
"General Motors will pay $220 million"
"General Motors will pay $220 million to settle allegations"
"This is the first settlement in Colorado resolving allegations under the Colorado Privacy Act."
"GM’s data collection and privacy practices violate our state’s data privacy and consumer protection laws."
"GM sold consumers’ data to data brokers, who then sold it to insurance companies"
"GM did not disclose to drivers that their data would be sold for this purpose."
$220.0M
General Motors agreed to pay $220 million to resolve allegations that it sold identifiable driver behavior and location data to data brokers and insurers without adequately disclosing the practice or obtaining consumers’ consent. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
$7.1M
A bipartisan coalition of 36 attorneys general settled allegations that General Motors collected and sold drivers’ driving-behavior and location data to data brokers, whose customers included insurance companies. GM will pay $220 million nationally, with Minnesota receiving $7,095,664, and must obtain affirmative express consent before collecting or disclosing driving and location data.
$12.8M
California Attorney General Rob Bonta, along with multiple district attorneys and the California Privacy Protection Agency, announced a $12.75 million settlement with General Motors for illegally selling hundreds of thousands of Californians' location and driving data to data brokers Verisk and LexisNexis without notice or consent. The settlement includes the largest CCPA penalty to date, a five-year ban on selling driving data to consumer reporting agencies, and requirements to delete retained data and implement a robust privacy program.
$12.8M
CalPrivacy and the California Attorney General secured a $12.75 million settlement from General Motors for data sharing practices from connected vehicles. The settlement includes injunctive terms to change business practices.
Texas Attorney General Ken Paxton filed a lawsuit against General Motors for unlawfully collecting private driving data from over 1.5 million Texas drivers without consent and selling the data to third parties including insurance companies. GM allegedly deceived customers into enrolling in products like OnStar Smart Driver by falsely claiming enrollment was required to retain vehicle safety features, while concealing that enrollment authorized systematic collection and sale of detailed driving data. The action follows an investigation launched in June 2024 as part of the Texas AG’s data privacy initiative, and seeks to hold GM accountable for violating state privacy laws.
Colorado, the FTC, and a bipartisan group of state attorneys general sued Toast, alleging misleading claims about its subscription services and financial products, undisclosed fees, and obstacles to cancelling subscriptions. The coalition is asking the court for an injunction, monetary relief, civil penalties, and other relief; the press release does not report an imposed penalty.