General Motors will pay $220 million in a nationwide settlement resolving allegations that it sold drivers’ behavior and location data to third parties without proper consent, including data brokers that supplied the information to insurers.

The settlement, announced October 29 by a coalition of attorneys general, requires GM to obtain affirmative express consent before collecting or disclosing driving and location data. Colorado will receive approximately $7.2 million.

The allegations center on GM’s Smart Driver program, which enrolled millions of drivers between 2016 and 2024. Marketed as a tool to improve driving safety, the program collected trip details, speeding information, and instances of hard braking and rapid acceleration. According to the attorneys general, GM sold the information under contracts specifying its use for insurance products, without disclosing that purpose to drivers. Insurers subsequently used the data in setting premiums.

Many customers enrolled at dealerships through a combined sign-up process for Smart Driver and OnStar. Dealership employees allegedly accepted terms on customers’ behalf without consent, while GM rewarded enrollment through bonuses and dealership rankings.

The investigation also found that the OnStar app incorrectly told more than 370,000 drivers they were not enrolled in Smart Driver, even as GM collected and sold their data. GM later unenrolled those drivers without notifying them of the error, leaving previously shared data with brokers and insurers.

GM discontinued Smart Driver following reporting by The New York Times. The settlement also requires limits on data collection, a comprehensive privacy program, internal and external assessments, and dealership oversight and training.