GM Reaches $12.75 Million Settlement Over Alleged Unauthorized Sale of Driver Data
By [Your Name], Senior Correspondent
[City, Date] – General Motors (GM) has agreed to pay $12.75 million in penalties and cease selling driver data to third-party brokers for five years as part of a landmark settlement with California authorities. The agreement, announced by California Attorney General Rob Bonta, resolves allegations that the automaker secretly collected and monetized sensitive driving behavior data—including geolocation, speed, and braking patterns—without customer consent, raising significant privacy concerns in an era of increasingly connected vehicles.
The case, which underscores growing scrutiny over corporate data-sharing practices, stems from a 2024 New York Times investigation revealing that GM and other automakers were supplying insurers with detailed driver analytics, potentially leading to higher premiums for consumers. While California’s strict insurance laws prevented rate hikes in this instance, the settlement highlights the broader ethical and legal dilemmas surrounding the opaque trade of personal data.
The Allegations: A Breach of Trust
According to the California Department of Justice, GM’s OnStar Smart Driver program—a telematics service marketed as a safety feature—collected granular driving metrics from hundreds of thousands of Californians between 2019 and 2024. This data was then allegedly sold to two major data brokers, Verisk Analytics and LexisNexis Risk Solutions, which specialize in providing risk assessments to insurers. GM reportedly earned approximately $20 million from these transactions.
“General Motors sold the data of California drivers without their knowledge or consent, despite repeated assurances that such practices would not occur,” Bonta stated. “This settlement forces GM to abandon these unlawful actions and reinforces the principle that companies cannot hoard consumer data for undisclosed commercial exploitation.”
The complaint further alleges that GM’s privacy disclosures were misleading, failing to explicitly inform customers that their driving habits could be shared with third parties. While the company discontinued Smart Driver in 2024, the settlement mandates that GM delete all retained driver data within 180 days—unless explicit user consent is obtained—and request that LexisNexis and Verisk purge the information from their systems.
Regulatory Backdrop: A Crackdown on Data Exploitation
The settlement is the latest in a series of regulatory actions targeting automakers’ data practices. In January 2026, GM finalized a separate agreement with the Federal Trade Commission (FTC), which barred the company and its OnStar subsidiary from sharing certain driver data with consumer reporting agencies. These cases reflect a broader push by U.S. and international regulators to rein in the largely unregulated data brokerage industry, which profits from the sale of personal information with minimal transparency.
California, home to the nation’s toughest privacy laws, has emerged as a key battleground. The California Consumer Privacy Act (CCPA) requires businesses to disclose data collection purposes and allows residents to opt out of sales. Bonta’s office emphasized that GM’s actions violated these principles, leveraging the state’s “data minimization” doctrine, which restricts companies from repurposing collected data beyond its original intent.
GM’s Response and Industry Implications
GM has denied wrongdoing, framing the settlement as a proactive resolution. In a statement to Reuters, the automaker noted that the agreement “addresses a discontinued product and aligns with our ongoing efforts to enhance privacy protections.” The company has since introduced stricter data-sharing controls, including clearer opt-in policies for telematics services.
Privacy advocates, however, argue that the case exposes systemic issues in the automotive sector. Modern vehicles, equipped with GPS, cameras, and internet connectivity, generate vast amounts of sensitive data—often without drivers fully understanding how it is used. “Cars have become data goldmines,” said Sarah Garcia, director of the Electronic Privacy Information Center. “This settlement is a warning: automakers must prioritize user consent, or face escalating legal and reputational risks.”
The fallout extends beyond GM. A 2025 Consumer Reports study found that 75% of major car brands reserve the right to share driver data with third parties, while only 30% offer clear opt-out mechanisms. With the FTC and state attorneys general increasing enforcement, analysts predict further litigation—and potential federal legislation—to standardize data privacy in the auto industry.
Global Context: Privacy in the Connected Car Era
The GM case mirrors similar controversies worldwide. In the European Union, the General Data Protection Regulation (GDPR) imposes heavy fines for unauthorized data sharing, prompting Volkswagen and BMW to revise their telematics policies. Meanwhile, China’s stringent data localization laws require automakers to store driver information domestically, complicating operations for global manufacturers.
Experts warn that without uniform standards, consumers remain vulnerable. “Data privacy shouldn’t depend on your zip code,” said Dr. Alan Ritter, a cybersecurity professor at MIT. “A driver in California has protections today that someone in Texas might not. We need federal rules to close these gaps.”
Conclusion: A Turning Point for Transparency
The $12.75 million penalty, while a fraction of GM’s $171 billion annual revenue, signals a pivotal shift in holding corporations accountable for data misuse. For consumers, the case serves as a reminder to scrutinize privacy policies—especially for connected devices.
As Bonta concluded: “When it comes to data privacy, consumers must be in the driver’s seat.” Yet with technology advancing faster than regulation, the road to meaningful transparency remains long—and fraught with challenges.
