Colorado AG secures $220m GM settlement over driver data sales

General Motors will pay $220m to settle allegations that it illegally sold consumers’ driving behaviour and location data to data brokers, which then sold it to insurers, the Colorado Attorney General said on 29 October 2026. Colorado will receive approximately $7.2m. Attorney General Phil Weiser joined 35 other attorneys general in the action, which was co-led by Washington and Oregon.

The settlement requires GM to obtain “affirmative express consent” before collecting or disclosing consumer driving and location data. It also requires GM to limit the driving data it collects, operate a comprehensive data privacy programme, conduct internal and external privacy assessments, and implement dealership oversight and training. This is Colorado’s first settlement resolving allegations under the Colorado Privacy Act.

For compliance teams, the case treats consent, product design, dealer conduct and downstream data use as one control problem. Firms should be able to show how consent is obtained, how data uses are disclosed and how third-party sharing is controlled.

What the coalition alleged

From 2016 to 2024, GM enrolled millions of drivers in its Smart Driver programme, which tracked driving habits. GM marketed the tool as a way to improve safety and told drivers that it would not share their data with insurers without express consent.

The coalition found that GM nevertheless sold the information to data brokers under contracts specifying that it could be used for insurance products. Insurers could receive information on how often a person drove, the start and end times of journeys, hard braking and acceleration, and whether the vehicle exceeded the speed limit. Insurers then used the information to change premiums in some cases.

Many customers enrolled at dealerships when buying a vehicle, through a process combining Smart Driver with GM’s OnStar services. The Colorado Attorney General said dealership employees allegedly accepted terms and conditions for customers without their consent. GM was heavily incentivising dealerships to enrol customers in connected-vehicle services, with employee bonuses and dealership rankings linked in part to enrolment numbers.

GM’s systems also failed to tell some drivers whether they were enrolled. The OnStar app incorrectly told more than 370,000 drivers that they were not enrolled in Smart Driver when GM was collecting and selling their data. GM later unenrolled those drivers without telling them about the error, while leaving their data with data brokers and insurers.

GM discontinued Smart Driver after reporting by *The New York Times* on the insurance use of the data.

The supervisory signal

The settlement’s most significant requirement is not the payment but the consent standard. GM must obtain affirmative express consent before both collection and disclosure. That gives the company two separate control points: the initial decision to track driving behaviour and any later decision to share it with another party.

The dealership measures also place responsibility on the distribution channel. Companies using retailers, dealers or other intermediaries to enrol customers will need controls showing that staff did not accept privacy terms on a customer’s behalf, and that sales incentives do not reward enrolment without informed agreement.

The settlement also reaches data minimisation and assurance. GM must limit the driving data it collects and submit to internal and external assessments of its privacy and data protection programme. In Atlas’s view, that combination signals that state enforcement may test not only whether a privacy notice exists, but whether the business can demonstrate that its collection, consent, vendor and monitoring systems operate as described.

Colorado’s recent enforcement record shows the same preference for operational remediation alongside substantial multistate settlements. In September, the Attorney General joined a $694m settlement with Credit Acceptance over alleged unaffordable lending and add-on product packing. In July, Colorado led a $45m settlement with Block requiring changes to Cash App’s fraud protections, customer support and disclosures. The GM resolution applies that same enforcement model to connected-vehicle data: payment, programme changes and continuing oversight.

The immediate benchmark for car manufacturers and connected-device providers is therefore whether consent is specific, affirmative and traceable through the full data chain, including dealership enrolment, broker contracts, insurer use and deletion or unenrolment.