General Motors has reached a privacy-related settlement with a group of law enforcement agencies led by California Attorney General Rob Bonta.

GM Drives Into Privacy Settlement: $12.75M Penalty for Unauthorized Driver Data Sales

In a significant development for automotive privacy, General Motors (GM) has agreed to a landmark settlement of $12.75 million with a coalition of state attorneys general, led by California Attorney General Rob Bonta. The agreement addresses allegations that the automaker engaged in the unauthorized collection and sale of extensive driver data, a practice that drew widespread concern and consumer backlash earlier in the year.

The settlement marks a critical juncture in the ongoing debate surrounding connected car technology and consumer data rights, reinforcing the growing legal and public pressure on automakers to prioritize privacy. The core of the dispute revolves around GM’s collection of sensitive driving behavior, geolocation, and personal identifying information through its OnStar program, particularly its “Smart Driver” feature, and the subsequent sale of this data to third-party data brokers.

Unpacking the Allegations: How Driver Data Became a Commodity

The controversy first gained widespread public attention in early 2024, following a report by The New York Times. The investigative piece highlighted how various automakers, including GM, were actively gathering detailed information about their customers’ driving habits and sharing it with insurance companies. This revelation sparked outrage among consumers, many of whom reported experiencing unexpected increases in their auto insurance premiums, suspecting a direct link to the data sharing.

California Attorney General Bonta’s office subsequently detailed the specific allegations against GM. The investigation claimed that GM sold “the names, contact information, geolocation data, and driving behavior data of hundreds of thousands of Californians” to prominent data brokers: Verisk Analytics and LexisNexis Risk Solutions. These companies, known for compiling comprehensive consumer profiles, then leveraged this data for various purposes, including actuarial assessments for insurance companies.

The data, according to Bonta’s office, was primarily collected through GM’s ubiquitous OnStar program, a telematics system integrated into many GM vehicles. The specific culprit identified by GM itself as the source of the data sharing was its “Smart Driver” feature. This feature, designed ostensibly to provide drivers with insights into their habits for potential savings, effectively became a conduit for data monetization, reportedly generating approximately $20 million in revenue for GM from these data sales.

The California Nuance: Insurance Laws and Data Minimization

While the national concern revolved around insurance rate hikes, California presented a unique scenario. Bonta’s office acknowledged that, in California, the collected driving data did not directly lead to increased insurance prices. This crucial distinction is “likely because under California’s insurance laws, insurers are prohibited from using driving data to set insurance rates.” This highlights California’s robust regulatory environment regarding consumer protection and data privacy, which often sets a precedent for other states.

Despite the lack of direct insurance impact in California, the core privacy violation remained. Attorney General Bonta emphasized that GM sold driver data “without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so.” This breach of trust and the failure to obtain explicit consent, regardless of the ultimate use of the data, formed the basis of the legal action.

Terms of the Settlement: A Blueprint for Future Data Governance

The settlement outlines a series of stringent requirements for General Motors, aiming to rectify past practices and establish a clearer path for future data governance:

• Civil Penalties: GM has agreed to pay $12.75 million in civil penalties, a substantial sum reflecting the seriousness of the privacy violations.
• Five-Year Sales Ban: For the next five years, GM is prohibited from selling driving data to any consumer reporting agencies, directly addressing the core issue that triggered the investigation.
• Data Deletion Mandate: GM must delete any driver data it still retains within 180 days, unless it obtains explicit consent from the customers. This is a critical step towards data minimization and ensuring that past unauthorized data is purged.
• Broker Data Deletion Request: The company is also required to request that LexisNexis Risk Solutions and Verisk Analytics delete the driver data they received from GM. This extends the accountability beyond GM itself, aiming to clean up the data trail.

California Attorney General Rob Bonta lauded the settlement, stating it “requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California’s privacy law — companies can’t just hold on to data and use it later for another purpose.” His statement highlights the proactive stance California is taking to enforce its privacy statutes, such as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), which empower consumers with greater control over their personal information.

A Pattern of Scrutiny: From FTC to State Actions

This isn’t GM’s first encounter with federal regulators over its data practices. The company had previously settled with the Federal Trade Commission (FTC) concerning its data sales. That prior action resulted in a final order specifically banning General Motors and OnStar from selling certain types of data to consumer reporting agencies. The repetition of similar issues suggests a systemic challenge within GM’s data handling protocols, or at least a persistent gray area regarding consent and transparency that has now been definitively addressed by multiple legal actions.

Responding to the latest settlement, GM told Reuters that the agreement “addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.” While the discontinuation of the “Smart Driver” feature is a positive step, the settlement underscores that proactive self-correction often comes only after significant regulatory intervention and public outcry. It also implies that the “Smart Driver” was indeed the primary vehicle for the data collection and sharing that led to the legal challenges.

The Broader Implications: Connected Cars and Consumer Trust

The GM settlement serves as a potent reminder of the vast amounts of data modern connected vehicles collect and the ethical and legal challenges associated with its use. From GPS navigation and infotainment systems to advanced driver-assistance features and remote diagnostics, cars are increasingly becoming data-generating machines. This data holds immense value for automakers, service providers, and potentially advertisers, but it also carries significant privacy risks for drivers.

This case sets a precedent, signaling to the entire automotive industry that regulators are actively monitoring data practices. Automakers will likely face increased pressure to enhance transparency, simplify consent mechanisms, and implement robust data governance frameworks that prioritize user privacy by default. Consumers, in turn, are becoming more aware of their digital footprints, even behind the wheel, and are demanding greater control over their personal information.

The move towards stricter enforcement aligns with a global trend in data privacy regulations, such as Europe’s GDPR and various state-level laws in the U.S. These regulations aim to shift the power dynamic from data collectors to data subjects, granting individuals more rights regarding access, deletion, and consent. For the automotive sector, this means a necessary pivot from maximizing data exploitation to building consumer trust through responsible data stewardship.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.