General Motors agreed on Thursday to pay $220 million to settle allegations that it sold drivers’ driving and location data without adequate consent, ending a multi-state investigation with a bipartisan coalition of 36 state attorneys general. Of that total, $12.75 million is a civil penalty. The rest goes to consumers and to the cost of changing how the company handles the data its vehicles collect.
The penalty is the smallest part of the deal, and that is the part worth understanding. State attorneys general negotiate these settlements on a template that weighs consumer harm against the cost of remediation, and a figure in which the fine is under 6% of the total tells you the harm was measured in millions of drivers rather than in a single violation. It also tells you the states were more interested in changing behavior than in collecting.
The conduct at issue was mundane and pervasive. GM’s vehicles, like most modern cars, log speed, braking, acceleration and location. Through a program called Smart Driver, available via its OnStar connected-services unit, the company enrolled drivers and shared their driving data with consumer reporting agencies, which used it in insurance scoring. Reporting in 2024 established that the data flowed to two such agencies and that some drivers saw premiums rise without knowing why. GM discontinued the program.
The consent problem was structural rather than a matter of paperwork. Enrollment happened at the dealership, often bundled into the delivery process, and the disclosure that data would be shared with insurers was not, in the states’ view, adequately separated from the decision to buy the car. A driver who wanted the connected services but not the data-sharing had no obvious way to get one without the other.
The settlement’s requirements reach further than the payment. GM must stop selling driving data to consumer reporting agencies. It must simplify the process by which a customer opts out, so that withdrawing consent does not require navigating a support queue. And it must submit to compliance audits for several years, an obligation that outlasts the news cycle and gives the states a mechanism to check whether the changes held.
California ran its own investigation and settled separately in May for $12.75 million, the same figure the multistate agreement assigns to its civil penalty. That symmetry is not accidental. State settlements are often calibrated against each other, and a state that moves first sets the reference price for everyone who follows.
The federal government has been pursuing the same facts on a different theory. The Federal Trade Commission brought a case against GM and OnStar over how the company obtained and used geolocation data, and the order that resolved it barred the sale of such data for five years. The states’ case and the federal case overlapped in substance, which is why the multistate total is dominated by restitution rather than by penalties: the punishment was largely allocated to the federal track.
For the industry, the settlement is a template with an unusually clear edge. Automakers have spent a decade adding connectivity to vehicles and treating the resulting data as an asset to be monetized, with privacy notices written by lawyers for other lawyers. The states have now established that a program which shares driving behavior with insurers requires affirmative, separable consent, and that a dealership delivery process does not supply it.
The exposure is not limited to GM. Nearly every manufacturer with a connected-services subscription has some version of a data-sharing arrangement, whether with insurers, fleet managers, advertisers or analytics firms. Most of those arrangements were built on the same consent architecture, and the states that signed this agreement have now demonstrated both the appetite and the mechanism to pursue them.
Insurance pricing is where the consumer harm actually lands, and it is the hardest part to unwind. A driver whose premium rose because of a score derived from data he did not knowingly provide has already paid the difference, and no part of a settlement restores the years in which he paid it. The restitution in this deal addresses the data sale, not the downstream pricing.
There is a broader argument the settlement does not resolve: whether a vehicle’s data belongs to its owner, its driver, or the manufacturer that built the sensors. Property law has no clean answer, privacy law varies by state, and the contracts that govern connected services are written to grant the manufacturer broad rights. The states have regulated the sale of the data without settling the ownership question, which means the next case will be about collection rather than distribution.
For GM, the financial cost is manageable. $220 million against a company that spends billions annually on product development is a line item, and the operational cost of a compliance program is smaller than the revenue the data business generated. The reputational cost is harder to price, because the customers most affected are the ones who bought the vehicle on the understanding that its software was a feature rather than a sensor array reporting on them.
The timing is awkward in a specific way. GM is selling software-defined vehicles on the premise that over-the-air updates and subscription services will produce recurring revenue, and it is now operating under an agreement that restricts one of the few data businesses it had built. Every automaker’s investor presentations include a slide about monetizing the connected car. The states have just narrowed what that slide can describe.
The larger question is whether consent can be made meaningful in a product where the data collection is continuous and largely invisible. A checkbox at delivery is not consent in any sense a regulator will accept, and an opt-out buried in a settings menu is not much better. The settlement requires GM to simplify its opt-out. It does not say what simple means, and that ambiguity will be litigated in the next agreement rather than this one.
