GM Pays $12.75M to Settle California Driver Data Privacy Lawsuit

General Motors has reached a significant settlement agreement worth $12.75 million to resolve a California data privacy lawsuit that centered on the automaker's controversial practices of selling driver location and behavioral information to third-party data brokers and insurance companies. The proposed settlement, filed on Friday, represents a major victory for consumer privacy advocates and sets an important precedent for the automotive industry regarding how manufacturers handle sensitive driver data.

The lawsuit accused General Motors of improperly monetizing driver location data and behavioral metrics collected through its connected vehicle systems without obtaining adequate consumer consent or providing meaningful opt-out options. According to the settlement terms, GM has committed to ceasing all sales of customer information to data brokers for a minimum of five years, effectively halting a lucrative but ethically questionable revenue stream for the Detroit-based automaker.

Additionally, the settlement mandates that GM must provide California drivers with enhanced controls over data collection through its OnStar service, one of the company's flagship connected vehicle platforms. Under the new agreement, customers will have the explicit ability to prevent OnStar from continuously tracking and collecting their precise location data, addressing one of the primary concerns raised by privacy advocates and state regulators.

The settlement emerged in the aftermath of a groundbreaking 2024 investigative report published by The New York Times that exposed how major automakers, including General Motors, Ford, and BMW, had been systematically sharing detailed driving data with data brokers and insurance companies. The report revealed that this information included sensitive behavioral metrics such as vehicle speed, hard braking events, rapid acceleration, and other driving patterns that could significantly impact insurance rates and premiums for consumers.

This practice of selling driver behavior data to insurance companies raised substantial concerns among consumer advocates, privacy experts, and state regulators who questioned whether consumers truly understood what information was being collected and how it would be used. The lack of transparency around data monetization created a situation where drivers could unknowingly have their insurance premiums affected based on information sold to insurers by their vehicle manufacturers.

California Attorney General Rob Bonta emphasized that the settlement reinforces an important principle: when it comes to data privacy protections, consumers must remain in the driver's seat. The attorney general's office argued that companies cannot simply exploit consumer data for profit without providing clear notice and meaningful choice to those consumers whose information is being collected and sold.

The General Motors settlement joins a growing wave of regulatory action targeting automakers' data practices. Following the New York Times investigation, several other vehicle manufacturers faced similar scrutiny and lawsuits regarding their collection and monetization of driver information. This broader pattern of enforcement reflects increasing awareness among regulators about the potential harms when companies leverage connected vehicle technology for financial gain without adequate consumer safeguards.

Beyond the financial penalty, the settlement includes several structural changes to how GM will handle customer data going forward. The automaker must implement more transparent privacy policies that clearly explain what data is collected through OnStar and connected vehicle features, how that data may be used, and what options consumers have to limit data collection. These disclosure requirements aim to ensure that consumers making purchasing decisions understand the data collection practices associated with GM vehicles.

The five-year moratorium on data sales represents a substantial commitment by General Motors, potentially costing the company millions in foregone revenue from data broker partnerships. However, industry observers note that this decision may reflect GM's recognition that consumer privacy concerns could impact vehicle sales and brand reputation if left unaddressed. The settlement allows the company to move forward without ongoing litigation while demonstrating responsiveness to consumer privacy concerns.

Consumer advocates have highlighted that this settlement, while significant, represents only a first step in addressing broader issues surrounding automotive data collection and monetization. Many privacy experts argue that stronger federal legislation may ultimately be necessary to establish consistent standards across the entire automotive industry, rather than relying on piecemeal state-level settlements and regulatory actions.

The OnStar service, which has been a flagship feature of GM vehicles for decades, provides valuable benefits to drivers including emergency assistance, vehicle diagnostics, and navigation services. However, the service's ability to continuously collect location data created the data privacy concerns that prompted the California investigation. Going forward, drivers will have clearer choices about whether to allow OnStar to maintain continuous access to their location information.

Industry analysts suggest that the GM settlement may influence how other automakers approach their own connected vehicle data policies and privacy practices. As consumers become increasingly aware of data collection practices, vehicle manufacturers face growing pressure to differentiate themselves through stronger privacy protections and more transparent data handling practices. Some manufacturers have already begun emphasizing privacy features as a competitive advantage in marketing their vehicles.

The settlement also underscores the evolving relationship between automotive technology and consumer privacy rights. As vehicles become increasingly connected and integrated with digital services, the data collection potential expands significantly. Manufacturers collect information about driving habits, vehicle location, maintenance records, entertainment preferences, and other personal details that could have substantial commercial value to various third parties.

Looking ahead, the General Motors settlement establishes important precedent that may inform future litigation, regulatory investigations, and industry standards regarding automotive data privacy. The case demonstrates that regulators are willing to pursue enforcement actions and that courts recognize the commercial harm to consumers when their personal information is sold without adequate consent. This development will likely influence how automakers structure their data governance frameworks and consumer consent mechanisms in the coming years.