General Motors’ (GM) recent $12.75 million settlement with the state of California over allegations of misusing customer driving data marks a watershed moment for data privacy in the automotive sector. This case, which follows closely on the heels of a Federal Trade Commission (FTC) settlement earlier this year, signals a new era of regulatory scrutiny and consumer expectations around how automakers collect, use, and monetize personal data. The implications reach far beyond GM, setting a precedent that will shape the competitive and compliance landscape for the entire industry.
What Sparked the Settlement?
The roots of the California lawsuit trace back to a 2024 New York Times investigation, which revealed that GM had been collecting detailed driving data from its OnStar telematics program and selling this information to data brokers, including Verisk Analytics and LexisNexis Risk Solutions. These brokers, in turn, marketed the data to auto insurers, potentially impacting insurance rates for drivers based on their behavior behind the wheel. The data included not only driving habits but also names, contact details, and geolocation information—raising the stakes for consumer privacy.
California’s Attorney General Rob Bonta led the legal action, alleging that GM’s practices violated state privacy laws by selling sensitive data without customers’ explicit consent. While California’s insurance regulations prevented insurers from directly using this data to adjust rates, the complaint underscored the broader risks of nonconsensual data sharing and the potential for consumer harm.
Settlement Terms: Beyond the Financial Penalty
While the $12.75 million civil penalty is a fraction of GM’s $122 billion annual revenue (2022), the non-monetary terms of the settlement are far more consequential for GM’s operations and for industry standards. According to the agreement, GM must:
- Cease selling driving data to consumer reporting agencies for at least five years
- Delete all retained driving data within 180 days unless explicit customer consent is obtained, with exceptions only for limited internal uses
- Develop and implement a comprehensive privacy program to assess and mitigate risks associated with data collection through OnStar
- Report privacy risk assessments and compliance measures to the California Department of Justice and other relevant agencies
- Revise privacy policies and consumer disclosures to provide greater transparency and clarity
Attorney General Bonta emphasized that the settlement “underscores the importance of data minimization in California’s privacy law—companies can’t just hold on to data and use it later for another purpose.” This principle, now codified in the settlement, will likely serve as a reference point for future enforcement actions across industries.
Industry Context: Data as a Double-Edged Sword
The automotive sector has rapidly evolved from a hardware-centric industry to a data-driven ecosystem. Modern vehicles, equipped with advanced telematics, infotainment systems, and connectivity features, generate vast streams of data—ranging from vehicle diagnostics to real-time location and driver behavior analytics. For automakers, this data is a strategic asset, fueling new business models such as usage-based insurance, predictive maintenance, and personalized mobility services.
However, as the GM case illustrates, the monetization of consumer data is fraught with legal, ethical, and reputational risks. The backlash against GM’s data-sharing practices highlights a growing tension: while data can unlock significant value for manufacturers and partners, it also exposes companies to regulatory penalties and erodes consumer trust if mishandled.
Regulatory Shifts: California’s Leadership and Broader Implications
California has long been at the forefront of privacy regulation in the United States, with landmark laws such as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) setting high standards for data protection. The GM settlement reinforces California’s role as a bellwether for privacy enforcement, particularly in sectors where personal data is integral to product functionality and business strategy.
Notably, the settlement’s requirement for data deletion and explicit consent aligns with global trends, such as the European Union’s General Data Protection Regulation (GDPR), which mandates data minimization and user control. For multinational automakers, this creates a complex compliance landscape, as they must harmonize practices across jurisdictions with varying legal requirements and enforcement rigor.
Competitive Landscape: Who Wins, Who Loses?
GM’s settlement sends a clear signal to competitors: robust data governance is no longer optional. Automakers that proactively invest in privacy-by-design, transparent disclosures, and consumer consent mechanisms will be better positioned to navigate regulatory scrutiny and build long-term brand loyalty. Conversely, companies that lag in these areas risk not only legal penalties but also competitive disadvantage as consumers become more privacy-conscious.
For data brokers like Verisk Analytics and LexisNexis Risk Solutions, the settlement may prompt a reassessment of their business models and partnerships with automakers. The ban on selling driving data to consumer reporting agencies in California could ripple across other states, especially as lawmakers and regulators take note of the case’s high profile and public impact.
Enterprise Perspective: Operational and Strategic Adjustments
For GM and its peers, the settlement necessitates a fundamental rethinking of data collection, storage, and sharing practices. Key operational changes include:
- Implementing granular consent management systems to ensure customers are fully informed and empowered to control their data
- Investing in advanced cybersecurity measures to safeguard sensitive information from breaches and unauthorized access
- Conducting regular privacy risk assessments and audits to identify vulnerabilities and demonstrate compliance
- Training employees and partners on evolving privacy obligations and ethical data stewardship
Strategically, automakers must weigh the benefits of data-driven innovation against the potential costs of regulatory action and reputational harm. The ability to demonstrate responsible data practices may become a differentiator in an increasingly competitive market, particularly as connected and autonomous vehicles become mainstream.
Technical Deep-Dive: The OnStar Data Ecosystem
GM’s OnStar program, a pioneer in telematics, exemplifies both the promise and peril of automotive data. OnStar collects a wide array of information, including vehicle diagnostics, navigation history, emergency response data, and, crucially, detailed records of driving behavior. This data can be used to enhance safety features, provide real-time assistance, and enable predictive maintenance—but it also creates a rich profile of individual drivers.
The controversy arose when GM sold this data to third-party brokers without obtaining explicit, informed consent from customers. While the company argued that data sharing enabled valuable services, the lack of transparency and opt-in controls triggered regulatory intervention. The settlement now forces GM to implement privacy impact assessments and limit data retention, setting a new technical baseline for the industry.
Industry Reactions: Signals from Regulators and Peers
Regulators across the United States are closely monitoring the GM case as a template for future enforcement. The FTC’s earlier settlement with GM over similar data-sharing practices at the federal level underscores a coordinated approach to privacy oversight. Industry groups, meanwhile, are urging members to review and update their data governance frameworks, anticipating that consumer advocacy groups and state attorneys general will intensify scrutiny of telematics and connected vehicle services.
Other automakers, such as Ford and Toyota, have reportedly initiated internal reviews of their own data collection and sharing protocols, seeking to preempt regulatory action and reassure customers. The settlement has also prompted calls for industry-wide standards on data privacy, with some stakeholders advocating for a national framework to harmonize requirements and reduce compliance complexity.
Risks and Challenges: Navigating a Fragmented Regulatory Landscape
One of the most significant challenges facing automakers is the patchwork of data privacy laws across different jurisdictions. While California and the European Union impose strict requirements on consent and data minimization, other states and countries have less comprehensive frameworks. This fragmentation complicates compliance for global manufacturers, increasing the risk of inadvertent violations and inconsistent consumer experiences.
Operationally, automakers must also address the technical challenges of data deletion, access controls, and auditability. Legacy systems may not be designed for granular consent management or rapid data purging, necessitating costly upgrades and process overhauls. The need to balance innovation with privacy—particularly as vehicles become more autonomous and interconnected—adds further complexity.
Strategic Outlook: The Road Ahead for Data Privacy in Automotive
The GM settlement is likely to accelerate a broader shift toward privacy-centric business models in the automotive sector. As vehicles generate ever-larger volumes of data, automakers will need to demonstrate not only compliance but also leadership in ethical data stewardship. This may involve:
- Developing user-friendly privacy dashboards that allow customers to view, manage, and delete their data
- Partnering with third-party auditors to validate privacy practices and build consumer trust
- Engaging with regulators and industry groups to shape emerging standards and best practices
- Exploring new revenue models that do not rely on the sale of personal data, such as anonymized analytics or subscription-based services
For consumers, the settlement represents a growing recognition of their rights and expectations in the digital age. As awareness of data privacy issues increases, companies that prioritize transparency and user empowerment are likely to enjoy a competitive edge.
Non-Obvious Implications: Second-Order Effects and Market Signals
Beyond the immediate compliance requirements, the GM case may have several less-visible but strategically significant effects. First, insurers and data brokers may face increased scrutiny over their own data sourcing and usage practices, potentially leading to tighter regulations and reduced access to granular driving data. Second, technology vendors supplying telematics and connectivity solutions to automakers may be asked to redesign systems with privacy-by-default architectures, shifting the competitive dynamics in the supplier ecosystem.
Finally, the settlement could spur innovation in privacy-enhancing technologies, such as edge computing and differential privacy, which allow for valuable insights without exposing individual-level data. Automakers that invest early in these capabilities may be better positioned to navigate the evolving regulatory and market landscape.
Future-Oriented Observation: The Coming Era of Autonomous and Smart Mobility
As the automotive industry moves toward autonomous vehicles and integrated smart transportation systems, the volume and sensitivity of data collected will only increase. The GM settlement is an early indicator of the heightened expectations and risks that will accompany this transition. Companies that fail to adapt may find themselves not only out of compliance but also out of favor with increasingly savvy consumers and regulators.
The next wave of innovation will require automakers to embed privacy and security into every layer of their technology stack, from sensor data collection to cloud analytics. Those that succeed will not only avoid costly penalties but also build the trust necessary to unlock the full potential of connected mobility.
Conclusion: A Defining Moment for Automotive Data Governance
GM’s $12.75 million settlement with California is more than a financial penalty—it is a strategic inflection point for the automotive industry. As vehicles become rolling data centers, the stakes for privacy, security, and consumer trust have never been higher. Automakers must now move beyond compliance to embrace a culture of transparency, accountability, and ethical innovation. The companies that rise to this challenge will shape the future of mobility—and define the new standard for digital trust in the automotive age.