Press Releases
10/29/2026
Attorney General Tong Announces GM to Pay $220m For Selling Drivers' Private Data
(Hartford, CT) – Attorney General William Tong today announced General Motors will pay $220 million to settle allegations that it illegally sold consumers’ private driver behavior data and location information to third parties, including data brokers who then sold the data to insurance companies. For many consumers, this data was used by insurance companies in part to set insurance rates.
Attorney General Tong helped lead a coalition of 36 attorneys general in the case against GM, and Connecticut will receive more than $6 million through the settlement. The settlement requires GM to obtain affirmative express consent from consumers before collecting or disclosing consumer driving and location data.
Connecticut first began investigating GM and issued an initial notice of violation in 2024—among the first such actions under the then newly enacted Connecticut Data Privacy Act (CTDPA). Connecticut later joined and helped lead the multistate coalition reaching today’s settlement.
“GM turned private vehicles into mobile insurance surveillance machines without consumer consent or awareness. GM profited from the sale of this personal driving data, and consumers paid the price in the form of higher premiums. This was an egregious violation of privacy, and this investigation was one of Connecticut’s very first actions under the Connecticut Data Privacy Act. We are holding GM accountable and sending a clear message to corporations that Connecticut will not hesitate to aggressively enforce our data privacy laws,” said Attorney General Tong.
From 2016 to 2024, GM enrolled millions of drivers in their Smart Driver program, which tracked their driving habits. GM pitched this tool as a way for drivers to improve their own driving safety and told drivers that they would not share their data with insurers without express consent.
However, the coalition found that GM sold this information to data brokers under contracts that specified the data was to be used for insurance products. The data brokers sold the data to insurance companies, who could then change the driver’s premium based on their driving habits. GM did not disclose to drivers that their data would be sold for this purpose.
The data GM sold was personal, identifiable, and specific. Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit. As documented in the New York Times, insurance companies then used this information to change rates, sometimes increasing their premiums. After the Times reported on these practices, GM discontinued the Smart Driver program.
GM’s illegal data collection and sale impacted over 10,283,000 Americans, including at least 123,143 Connecticut residents.
Most customers who signed up for Smart Driver did so at the GM dealership when they bought their car. GM used one sign-up process for drivers to enroll in Smart Driver along with GM’s OnStar services. In many cases, dealership employees allegedly accepted terms and conditions on behalf of customers without their consent. At the time, GM was heavily incentivizing dealerships to sign up as many customers for OnStar as possible. Sales employees received bonuses based in part on how many customers they signed up for GM’s connected vehicle services and dealerships were ranked based on their enrollment numbers.
GM’s own systems failed to notify drivers about whether their data was being tracked. The OnStar app mistakenly told more than 370,000 drivers that they were not enrolled in Smart Driver, when they actually were enrolled and GM was collecting and selling their data. GM later quietly unenrolled these 370,000 drivers without telling them about the mistake and left their data with the data brokers and insurance companies.
The settlement also requires GM to limit the driving data it collects from consumers and protect their personal information going forward as part of a comprehensive data privacy program. These data privacy terms, which Connecticut played a key role in drafting, are significantly stronger than any other resolution reached with GM for this conduct including by mandating internal and external data protection and privacy program assessments. GM also agreed to oversight and training requirements at their dealerships to protect consumers against being enrolled in data collection schemes without their consent. Several consumer class action cases remain pending against GM. The Federal Trade Commission settled with GM on January 16, 2025. That settlement provided for limited injunctive relief and did not include any monetary payment.
The case was co-led by Washington and Oregon, assisted by the Executive Committee of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah, and Vermont, and joined by the attorneys general of Alabama, Alaska, Arizona, the District Of Columbia, Florida, Hawai’i, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, and Wisconsin.
Assistant Attorney General Patrick Kania and Deputy Associate Attorney General Michele Lucan, Chief of the Privacy and Data Security Section assisted the Attorney General in this matter.
- Twitter: @AGWilliamTong
- Facebook: CT Attorney General
Media Contact:
Elizabeth Benton
elizabeth.benton@ct.gov
Consumer Inquiries:
860-808-5318
attorney.general@ct.gov