Attorney General Ellison wins $7.1M from General Motors for sharing drivers’ private data

AG Ellison helped lead bipartisan coalition of 36 AGs in settlement worth $220M nationally

Settles allegations General Motors sold consumers’ private driver behavior data and location information to third parties, including data brokers who sold data to insurance companies

Minnesotans can visit privacymn.org to learn more about their data-privacy rights under Minnesota law

October 29, 2026 (SAINT PAUL) — Minnesota Attorney General Keith Ellison announced today that he has joined a bipartisan coalition of 36 attorneys general in a settlement with General Motors (“GM”). GM will pay $220 million to settle allegations that it illegally sold consumers’ private driver behavior data and location information to third parties, including data brokers who then sold the data to insurance companies. For many consumers, this data was used by insurance companies in part to set insurance rates.

Minnesota will receive $7,095,664 from the settlement. The settlement also requires GM to obtain affirmative express consent from consumers before collecting or disclosing consumer driving and location data.

Attorney General Ellison served on executive committee of the bipartisan coalition.

“Minnesotans and Americans everywhere have had it with corporations, Big Tech, and shady interests collecting and selling their data without their knowledge or consent,” Attorney General Ellison said. “General Motors secretly collected consumers’ private driver behavior data that was ultimately used to set many consumers’ insurance rates. This is egregious behavior and I’m proud to have helped this bipartisan coalition put a stop to it and get legal guarantees that GM will not do it again. Any other corporation that’s secretly collecting consumers’ data without their consent is likely breaking Minnesota law and had better stop now.”

GM collected personal information from drivers without their knowledge or consent

From 2016 to 2024, GM enrolled millions of drivers in their Smart Driver program, which tracked their driving habits. GM pitched this tool as a way for drivers to improve their own driving safety and told drivers that they would not share their data with insurers without express consent.

However, Attorney General and the bipartisan coalition he helped lead found that GM sold this information to data brokers under contracts that specified the data was to be used for insurance products. The data brokers sold the data to insurance companies, who could then change the driver’s premium based on their driving habits. GM did not disclose to drivers that their data would be sold for this purpose.

Most customers who signed up for Smart Driver did so at the GM dealership when they bought their car. GM used one sign-up process for drivers to enroll in Smart Driver along with GM’s OnStar services. In many cases, dealership employees allegedly accepted terms and conditions on behalf of customers without their consent. At the time, GM was heavily incentivizing dealerships to sign up as many customers for OnStar as possible. Sales employees received bonuses based in part on how many customers they signed up for GM’s connected vehicle services and dealerships were ranked based on their enrollment numbers.

GM’s own systems failed to notify drivers about whether their data was being tracked. The OnStar app mistakenly told 370,000 drivers that they were not enrolled in Smart Driver, when they actually were enrolled and GM was collecting and selling their data. GM later quietly unenrolled these 370,000 drivers without telling them about the mistake and left their data with the data brokers and insurance companies.

The data GM sold was personal, identifiable, and specific. Insurers had data showing how many times a person drove their vehicle, the start and end times of each drive, how many times they braked or accelerated quickly, and whether they went faster than the speed limit. As the New York Times documented, insurance companies then used this information to change rates, sometimes increasing their premiums. After the Times reported on these practices, GM discontinued the Smart Driver program.

The settlement also requires GM to limit the driving data it collects from consumers and protect their personal information going forward as part of a comprehensive data privacy program. The terms secured by the coalition are significantly stronger than any other resolution reached with GM for this conduct including by mandating internal and external data protection and privacy program assessments. GM also agreed to oversight and training requirements at their dealerships to protect consumers against being enrolled in data collection schemes without their consent.

Minnesotans’ rights under the Minnesota Consumer Data Privacy Act

GM stopped the Smart Driver program before the Minnesota Consumer Data Privacy Act (MCDPA) went into effect, but GM remains subject to the law’s requirements. The MCDPA includes heightened protections for sensitive data such as location data, limits on how the data may be used and retained, and the ability for consumers to stop the sale of their data via opt-out rights. Minnesotans can visit privacymn.com to learn more about their data privacy rights, how to enforce those rights, and how to report any violations of those rights.

Joining Attorney General Ellison in the settlement with GM are the attorneys general of Washington and Oregon, who co-led the coalition; the attorneys general of Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, New Jersey, Utah, and Vermont, who served on the coalition’s executive committee along with Attorney General Ellison; and the attorneys general of Alabama, Alaska, Arizona, the District of Columbia, Florida, Hawai’i, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Virginia, and Wisconsin.