General Motors will pay $220 million to settle allegations from 36 states that it sold drivers’ data to brokers, who then funneled it to insurance companies. Those insurers used the information to jack up rates on the very people driving GM vehicles.
The settlement, reported by TechCrunch, also mandates a third-party audit of GM’s privacy programs going forward. The goal is straightforward: make sure the automaker doesn’t do it again.
Thirty-six states. That’s not a rogue attorney general looking for headlines. That’s nearly three-quarters of the country deciding GM crossed a line. The scale of the coalition tells you everything about how widespread the data harvesting was and how little effort GM made to hide it.
The mechanics were simple and ugly. GM collected driving data from its connected vehicles and sold it to brokers. Those brokers sold it to insurance companies, which used it to raise premiums on GM’s own customers. The automaker was monetizing its owners twice, once at the dealership and again through a data pipeline those owners never knowingly signed up for.
Two hundred and twenty million dollars sounds like a big number until you remember GM pulled in $171 billion in revenue last year. It’s a rounding error. The real sting, if there is one, comes from the reputational damage and the audit requirement, which puts an outside set of eyes on GM’s data practices for the foreseeable future.
This isn’t GM’s first brush with data controversy. Reports surfaced in 2024 that OnStar data was being shared with LexisNexis, one of the largest consumer data brokers in the country. Drivers discovered their insurance rates had spiked after buying GM vehicles, with detailed trip-level data appearing in their insurance risk profiles.
What changed between then and now is that states actually followed through. They investigated, they built cases, and they extracted a settlement with enforcement teeth. The third-party audit is the part GM likely resisted hardest. It’s one thing to write a check. It’s another to let outsiders poke around your data infrastructure indefinitely.
The broader question hanging over every automaker is whether connected vehicles have become surveillance tools that happen to provide transportation. Every modern car with a cellular modem is generating torrents of data about where you go, how fast you drive, how hard you brake. The value of that data to third parties is enormous, and the legal framework governing its use is still catching up.
GM is the first major automaker to pay this kind of price for data practices, but it won’t be the last. Every manufacturer with a connected services platform is sitting on the same temptation. The difference between GM and the rest may simply be that GM got caught first.
The audit clock starts now. Whether it actually changes behavior or just adds a compliance layer to the same underlying business model is a question that won’t be answered for years.
Share this Story