General Motors will pay $220 million to 36 states to settle allegations that it sold private driving-behavior and location data to data brokers without required consent, Connecticut Attorney General William Tong and the automaker said Thursday^1,2.

The deal requires GM to obtain drivers' express consent before collecting or sharing driving and location data, terms that TechCrunch said match earlier resolutions with California and the Federal Trade Commission^1,2. TechCrunch reported a new obligation that a third party assess GM's privacy-program compliance¹.

Tong said Connecticut will receive more than $6 million². He said the company sold the information to brokers, who sold it to insurers that used it in part to set rates².

From 2016 to 2024, GM enrolled millions of drivers in Smart Driver, a connected-car feature that tracked driving habits². WTNH reported GM told drivers it would not share data with insurers without express consent; Tong said GM did not disclose the data would be sold for insurance purposes². GM discontinued Smart Driver in June 2024, according to a company spokesperson cited by WTNH².

Tong said the alleged collection and sale affected more than 10,283,000 people, including at least 123,143 Connecticut residents². He said GM systems failed to notify some drivers they were being tracked, and that the OnStar app told more than 370,000 drivers they were not enrolled in Smart Driver when they were².

Connecticut began investigating GM and issued a notice of violation in 2024 under the then-new Connecticut Data Privacy Act, then joined the multistate settlement, WTNH reported².

GM said the agreement addresses Smart Driver and reinforces steps it has taken on privacy practices^1,2. The company said it is committed to being clear about what information is used, how it is protected, and the choices customers have^1,2. GM said the deal is consistent with prior FTC and California resolutions on Smart Driver².

TechCrunch reported GM now says it will no longer sell vehicle information that can be linked to an individual, a vehicle's location, or how someone drives, while it may still disclose anonymized data not tied to a person¹. The outlet also described planned OnStar features that would let customers manage what data is shared¹.

What remains unknown includes how insurers used the data in individual rate decisions, how the $220 million will be allocated beyond Connecticut's stated share, and how the third-party assessment will be structured^1,2.