GM Caught Selling Driver Data Without Consent
General Motors has agreed to pay $12.75 million to settle a privacy lawsuit brought by a coalition of law enforcement agencies led by California Attorney General Rob Bonta. The settlement resolves allegations that the automaker collected and shared detailed personal driving data from millions of vehicle owners — without their meaningful knowledge or consent.
The case centres on GM's now-discontinued OnStar Smart Driver program, which tracked granular behavioural data including hard braking, rapid acceleration, and late-night driving. That data was then allegedly sold to third-party insurers, who used it to adjust — and in many cases raise — drivers' premiums.
What Data Was Collected?
According to investigators, GM gathered highly sensitive telematics data from connected vehicles, including:
- Trip-by-trip driving behaviour (speed, braking patterns, distance)
- Location history
- Time of day and frequency of driving
This data was reportedly shared with data brokers and insurers like LexisNexis and Verisk — companies that compile consumer risk profiles. Many drivers only discovered their data had been sold when they received unexpected insurance rate hikes or found entries in their consumer reports they didn't recognize.
A Growing Privacy Reckoning for Automakers
The settlement is part of a broader national reckoning over how connected vehicles handle personal data. Modern cars are essentially rolling data collection platforms, equipped with sensors, cameras, microphones, and always-on internet connections. The problem is that privacy policies are often buried in lengthy terms of service documents that few consumers read — let alone understand.
California's action against GM is significant because it signals that state attorneys general are prepared to hold automakers accountable using existing consumer protection and privacy laws, even without comprehensive federal vehicle data regulations.
Attorney General Bonta stated that consumers have a right to know how their data is being used and that corporations cannot profit from personal information shared without genuine informed consent.
What the Settlement Requires
Beyond the $12.75 million payout, GM is required to implement stronger consent mechanisms for data collection programs going forward. The company had already wound down the Smart Driver program in early 2024 following earlier media investigations and consumer backlash.
The settlement funds are expected to be directed toward consumer privacy enforcement efforts and restitution for affected drivers, though the exact distribution mechanism was not immediately detailed.
Why This Matters Beyond California
For consumers across North America — including Canadians who drive GM vehicles — this case raises important questions. Canadian privacy law (PIPEDA and provincial equivalents like Quebec's Law 25) places similar obligations on companies to obtain meaningful consent before collecting and sharing personal data. However, enforcement in the automotive space has lagged behind compared to California's more aggressive regulatory posture.
Consumer advocates are calling on Canadian federal and provincial regulators to conduct their own reviews of automaker data practices, particularly as connected vehicle technology becomes standard across all price ranges.
For now, GM's settlement sends a clear message to the auto industry: driver data is personal data, and monetizing it without clear consent comes with serious legal and financial consequences.
Source: TechCrunch — GM agrees to pay $12.75M in California driver privacy settlement
