Penalty Amount
$220,000,000
General Motors agreed to pay $220 million to resolve allegations that it sold identifiable driver behavior and location data to data brokers and insurers without adequately disclosing the practice or obtaining consumers’ consent. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
GM will pay $220 million, of which Virginia will receive $6,541,173. The settlement requires affirmative express consent before collecting or disclosing consumer driving and location data, limits the driving data collected, requires a comprehensive privacy program with internal and external assessments, and imposes dealership oversight and training requirements.
Review connected-vehicle vendor and data-processing agreements for limits on collecting and sharing driving behavior and location data, express-consent requirements, restrictions on onward transfers to data brokers and insurers, and controls on using data for insurance products or rate-setting. Check customer privacy notices and consent flows to ensure they accurately explain tracking, enrollment, and disclosures, and ensure vendor terms require accurate enrollment-status communications and prompt correction of errors. Review dealership and sales agreements for consent responsibilities, enrollment practices, incentive structures, oversight, and training requirements; add audit rights and privacy-program assessment obligations where appropriate.
Entity
General Motors
Industry
AutomotiveOfficial Press Release
https://www.oag.state.va.us/media-center/news-releases/3145-attorney-general-jones-secures-6-5-million-for-the-commonwealth-in-general-motors-data-privacy-settlement
Virginia General Motors filed Complaint and Consent Judgment
https://www.oag.state.va.us/files/Virginia-General-Motors-filed-Complaint-and-Consent-Judgment-10-29-26.pdf
Virginia Attorney General Enforcement Page
https://www.oag.state.va.us/consumer-protection/
"General Motors will pay $220 million to settle allegations"
"General Motors will pay $220 million to settle allegations"
"the Commonwealth will receive $6,541,173 through the settlement"
"Virginia Consumer Data Protection Act"
"Virginia Consumer Protection Act"
"illegally sold consumers’ private driver behavior data and location information to third parties, including data brokers who then sold the data to insurance companies"
$220.0M
General Motors agreed to a nationwide $220 million settlement over allegations that it sold drivers’ identifiable driving behavior and location data to data brokers, which then sold it to insurers. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
$7.1M
A bipartisan coalition of 36 attorneys general settled allegations that General Motors collected and sold drivers’ driving-behavior and location data to data brokers, whose customers included insurance companies. GM will pay $220 million nationally, with Minnesota receiving $7,095,664, and must obtain affirmative express consent before collecting or disclosing driving and location data.
$12.8M
California Attorney General Rob Bonta, along with multiple district attorneys and the California Privacy Protection Agency, announced a $12.75 million settlement with General Motors for illegally selling hundreds of thousands of Californians' location and driving data to data brokers Verisk and LexisNexis without notice or consent. The settlement includes the largest CCPA penalty to date, a five-year ban on selling driving data to consumer reporting agencies, and requirements to delete retained data and implement a robust privacy program.
$12.8M
CalPrivacy and the California Attorney General secured a $12.75 million settlement from General Motors for data sharing practices from connected vehicles. The settlement includes injunctive terms to change business practices.
Texas Attorney General Ken Paxton filed a lawsuit against General Motors for unlawfully collecting private driving data from over 1.5 million Texas drivers without consent and selling the data to third parties including insurance companies. GM allegedly deceived customers into enrolling in products like OnStar Smart Driver by falsely claiming enrollment was required to retain vehicle safety features, while concealing that enrollment authorized systematic collection and sale of detailed driving data. The action follows an investigation launched in June 2024 as part of the Texas AG’s data privacy initiative, and seeks to hold GM accountable for violating state privacy laws.
Virginia joined a multistate lawsuit challenging a FinCEN rule that exempts nearly all businesses from beneficial-ownership reporting and the agency’s plan to delete ownership information already collected. The states allege violations of the Corporate Transparency Act and Administrative Procedure Act and seek to have the rule set aside and the ownership database maintained; no court outcome or monetary penalty is reported.