The automaker has agreed to a $220 million settlement tied to allegations that it collected and sold detailed information about how customers drove their vehicles, including location data, without properly informing them or getting their consent. The deal marks one of the largest penalties levied against a carmaker over data privacy practices and signals growing regulatory scrutiny of how connected vehicles harvest and monetize driver information.
As part of the agreement, GM is now required to obtain explicit, affirmative consent from drivers before it can collect or share their driving and location data going forward. That's a meaningful shift from the opt-out or buried-in-fine-print consent models that automakers have relied on for years, where drivers often had little idea that their braking habits, speed, and routes were being logged and potentially sold to third parties like insurance companies.
The case highlights a broader problem across the auto industry: modern vehicles are rolling data-collection platforms, packed with sensors and connected services that quietly generate huge volumes of personal information. Automakers have increasingly treated that data as a revenue stream, selling driving behavior profiles to insurers who use them to adjust premiums or flag risky drivers — often without customers realizing their own car was the source.
For GM, the settlement represents a costly reckoning and a forced overhaul of its data practices. The company will need to build new consent mechanisms into its vehicles and apps, likely prompting other automakers to review their own data-sharing agreements before they face similar legal exposure. Regulators and privacy advocates have been pushing for stricter rules around connected-car data for years, and this settlement gives that push real teeth.
Beyond GM, the ruling could reshape how the broader auto industry handles telematics data. With regulators demonstrating a willingness to impose nine-figure penalties, automakers may move faster to adopt transparent consent flows rather than risk litigation. Drivers, meanwhile, gain a clearer legal expectation that their vehicle's behavior data isn't fair game for quiet resale — a precedent that could ripple into negotiations with insurers and data brokers who've built business models around that information.