Court Rules
All enforcement actions
SettlementCritical RiskMultistate

Connecticut-led multistate settlement with General Motors over driver data

General Motors LLCOctober 29, 2026Connecticut Attorney General

Penalty Amount

$220,000,000

Consumers Affected

10,283,000

Summary

Connecticut and a coalition of 36 attorneys general reached a $220 million settlement with General Motors over the collection and sale of consumers’ driving behavior and location data to data brokers and insurers without adequate disclosure or consent. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy program assessments and dealership oversight and training.

Remedy

GM will pay $220 million and must obtain affirmative express consent before collecting or disclosing consumer driving and location data. It must limit the driving data it collects, implement a comprehensive data privacy program with internal and external assessments, and provide dealership oversight and training to prevent enrollment without consumer consent.

Monetary PenaltyInjunctionCompliance ProgramAudit Requirement

Contract Impact

Review vendor and data-processing agreements with telematics providers, data brokers, and analytics partners for express-consent requirements, limits on collecting and disclosing driving and location data, purpose restrictions, and prohibitions on onward sale or use for insurance products or pricing. Check customer-facing privacy notices and connected-vehicle terms for clear disclosures about tracking, sharing, and downstream uses, and ensure consent is affirmative, specific, and not obtained through bundled or unauthorized dealership enrollment. Review dealership and employee procedures, incentives, training, and oversight provisions, along with audit and assessment rights, data minimization obligations, and mechanisms to correct inaccurate enrollment status and address data already shared.

Contract Search Terms

affirmative express consenttelematics data collectiondriving behavior datalocation data sharingdata broker restrictionsinsurance use restrictionsprivacy notice and purpose limitationdealer enrollment authorizationdata protection assessments

Laws Cited

Connecticut Data Privacy Act (CTDPA)

Violation Types

Entity Details

Entity

General Motors LLC

Industry

Automotive

Multistate Coalition

WashingtonOregonColoradoConnecticutDelawareIllinoisKentuckyMarylandMinnesotaNew JerseyUtahVermontAlabamaAlaskaArizonaDistrict of ColumbiaFloridaHawai’iIdahoKansasMaineMassachusettsMichiganMississippiNevadaNew HampshireNew YorkNorth CarolinaNorth DakotaOhioOklahomaPennsylvaniaSouth CarolinaSouth DakotaVirginiaWisconsin

Official Sources

Source Evidence

Entity Name
"General Motors will pay $220 million to settle allegations"
Fine Amount
"will pay $220 million"
Laws Cited
"under the then newly enacted Connecticut Data Privacy Act (CTDPA)"
Violation Types
"illegally sold consumers’ private driver behavior data and location information to third parties, including data brokers who then sold the data to insurance companies."
Consent Failure
"The settlement requires GM to obtain affirmative express consent from consumers before collecting or disclosing consumer driving and location data."
Consumers Affected
"impacted over 10,283,000 Americans, including at least 123,143 Connecticut residents."

Related Enforcement Actions

NY

General Motors LLC

$220.0M

New York Attorney General Letitia James and a bipartisan coalition secured a $220 million settlement from General Motors LLC for selling drivers’ personal driving and location data to data brokers without adequate disclosure or consent. GM must limit the driving data it collects and implement privacy assessments and dealership oversight and training.

CT

Meta Platforms, Inc.

Connecticut Attorney General William Tong and 13 other attorneys general sent Meta a letter after the No Kings Coalition’s Instagram account was mistakenly suspended during a nationwide election-related day of action. The letter asks Meta to explain the suspension, its use of human review, steps to prevent similar errors, and how users can seek redress; it does not announce a fine or impose a remedy.

CT

Dollar General Corporation

Connecticut joined the FTC and attorneys general from 19 other states in suing Dollar General, alleging that it repeatedly charged customers more at checkout than prices displayed on shelves, tags, and advertisements. The complaint alleges years of overcharging and insufficient safeguards, but the release does not report a settlement, court order, or monetary penalty.

CT

SunRun, Inc.

$500K

Connecticut Attorney General William Tong announced settlements with SunRun, Inc., Elevate Solar Solutions, and two salespeople over allegations of deceptive solar sales, including impersonating consumers and locking homeowners into long-term contracts without consent. SunRun must pay $300,000 and provide consumer relief; Elevate and the salespeople face a stated $200,000 penalty, with $100,000 suspended subject to ongoing compliance.

CT

Mylan

$8.0M

Connecticut announced an $8 million settlement with Mylan over allegations that it used agreements to delay generic EpiPen competitors and took other actions that inflated prices. Mylan also agreed to provide 10,000 free EpiPens; the release states that Mylan denies wrongdoing.

CT

U.S. Department of Homeland Security

Connecticut Attorney General William Tong joined a coalition of 22 attorneys general in filing an amicus brief challenging DHS’s policy and practice of conducting warrantless civil immigration arrests. The press release describes a court challenge, not a privacy enforcement action or monetary penalty.