General Motors Fined for Selling Drivers' Data Without Consent

Major Fine for Personal Data Breach

General Motors has agreed to pay $12.75 million (approximately €11.7 million) to settle a California investigation into the collection and sale of driving data. California's Attorney General Rob Bonta revealed that GM collected and sold detailed driving information on hundreds of thousands of motorists without their consent.

The settlement imposes significant restrictions on how GM can use data from its OnStar service. The automaker is prohibited from selling this information to data brokers and faces a five-year ban on monetizing personal data linked to drivers' behavior.

Highly Sensitive Data at the Heart of the Case

Investigators found that General Motors collected and sold particularly sensitive information:

• Personal identification : driver names, phone numbers, and home addresses
• Precise GPS location data : tracking routes, parking locations, and travel patterns
• Driving behavior metrics : vehicle speeds and aggressive acceleration events

This data, gathered between 2016 and 2024, was allegedly sold to data brokers. According to California authorities, General Motors generated approximately $20 million in revenue nationally from selling this driving data.

A Systemic Problem Across the Auto Industry

The GM case reflects broader concerns about data collection from connected vehicles. In 2023, California's privacy agency launched investigations into automakers' data practices. During 2024, multiple media investigations revealed that some manufacturers were sharing driving data with insurance companies, potentially to adjust premium rates.

The Federal Trade Commission (FTC) characterized GM's conduct as a "flagrant betrayal of consumer trust." In January 2025, the FTC announced that GM and its OnStar subsidiary committed to withholding sensitive geolocation and driving behavior data for five years.

GM's Response and Enhanced Transparency Commitments

General Motors stated the settlement primarily addresses its Smart Driver product, which the company discontinued in 2024. GM claims this settlement aligns with its effort to strengthen data protection and privacy policies.

The company also pledged to improve transparency with customers regarding data collection and use from connected vehicles. GM emphasizes that drivers must have the ability to understand and control information shared through its embedded services.

This case highlights growing challenges around automotive data in an industry undergoing rapid technological transformation. Modern connected vehicles generate substantial amounts of information about driving habits and user behavior—a reality that all manufacturers must now handle with strict compliance and genuine privacy protections.

Source: leblogauto