General Motors has agreed to pay $12.75 million to settle a California data privacy lawsuit alleging the automaker sold customers' driving habit data — including speed, hard braking, and rapid acceleration — to data brokers who passed it on to insurance companies, without drivers' meaningful knowledge or consent.
General Motors reached a proposed settlement Friday with California's attorney general, agreeing to pay $12.75 million and accept new restrictions on its data-sharing practices, according to court documents filed this week and first reported by Reuters.
Under the terms of the agreement, GM must stop selling customer information to data brokers for a period of five years. The company is also required to give California drivers a clear mechanism to prevent its OnStar connected-vehicle service from collecting location data — a significant concession given that OnStar is embedded in millions of GM vehicles.
The case stems from a March 2024 investigation by The New York Times that revealed several major automakers, including GM, had been quietly sharing detailed driving behavioural data with data brokers. Those brokers, in turn, sold the information to insurance companies, which used it to assess risk and, in some cases, raise premiums. The data collected included metrics such as vehicle speed, frequency of hard braking, and instances of rapid acceleration — the kind of granular behavioural profile typically associated with opt-in telematics programmes.
The revelations triggered a wave of lawsuits and regulatory scrutiny. California Attorney General Rob Bonta, whose office led the state's probe, said in a statement that consumers must be "in the driver's seat" when it comes to their personal data. The settlement requires court approval before it takes effect.
GM has not admitted wrongdoing as part of the agreement, which is standard practice in civil settlements of this type. The company had previously announced in 2024 that it was winding down its data-sharing arrangements with brokers amid the mounting legal and public pressure.
The settlement covers conduct tied to GM's Smart Driver programme, which the automaker marketed to customers as a tool for improving their driving habits. Critics alleged the programme's data-sharing implications were not adequately disclosed to enrollees.
The $12.75 million figure, while significant, is modest relative to GM's annual revenue of roughly $187 billion. Consumer advocates have noted that the behavioural restrictions — particularly the five-year moratorium on data broker sales and the expanded opt-out for OnStar — may prove more consequential in the long run than the financial penalty.
The settlement adds to growing pressure on automakers and technology companies to be more transparent about the data collected by internet-connected vehicles, which can generate thousands of data points per hour of driving.
Analysis
Why This Matters
- Connected vehicles now collect vast amounts of behavioural data, and this case establishes a precedent that automakers can face significant legal and financial consequences for sharing that data without adequate consumer disclosure.
- Drivers across the US who enrolled in telematics or connected-vehicle programmes may have had their insurance premiums affected by data they didn't know was being shared — the settlement signals regulators are taking this seriously.
- The five-year data broker ban and expanded opt-out requirements could become a template for other states crafting their own vehicle data privacy rules.
Background
The case has its roots in the rapid expansion of connected-vehicle technology over the past decade. Automakers integrated cellular and GPS capabilities into their fleets, creating a lucrative stream of granular behavioural data. Programmes like GM's OnStar and Smart Driver were presented to consumers primarily as safety and driver-improvement tools, with data monetisation terms often buried in lengthy terms-of-service agreements.
The business model came into sharp public focus in March 2024, when The New York Times published an investigation revealing that GM and other manufacturers had been feeding driving data to brokers such as LexisNexis and Verisk. Insurance companies then used this data — sometimes without customers realising their insurer had access to it — to set or adjust premiums. The report prompted immediate congressional interest and multiple state-level investigations.
California, home to some of the strongest consumer privacy protections in the United States under the California Consumer Privacy Act (CCPA), moved quickly to investigate GM's practices. The state has increasingly used its legal framework as a lever to shape national corporate behaviour on data privacy, given that companies operating in California must often apply policy changes more broadly.
Key Perspectives
California Attorney General's Office: Framed the settlement as a consumer protection victory, emphasising that drivers deserve transparency and control over data generated by their own vehicles. The office highlighted the behavioural remedies — particularly the opt-out provisions — as meaningful wins beyond the monetary penalty.
General Motors: Has not admitted wrongdoing and had already begun distancing itself from data broker arrangements in 2024 before the settlement was finalised. The company faces pressure to reassure customers that its connected-vehicle services, including the relaunched OnStar platform, operate transparently.
Critics and Consumer Advocates: While welcoming the outcome, some privacy advocates argue the $12.75 million penalty is too small to deter similar conduct by large corporations. They also note that a five-year restriction on data broker sales leaves open the question of what happens after that period expires, and call for permanent legislative protections rather than time-limited settlements.
What to Watch
- Whether a California court formally approves the proposed settlement, which is not yet finalised.
- Legislative activity in other states and at the federal level: several bills targeting vehicle data privacy have been introduced, and this settlement may accelerate their progress.
- How other automakers — including those named in the original NYT investigation — respond, either by proactively changing their data practices or awaiting further regulatory action.