GM pays $220M for selling driver data that reached insurers

General Motors is writing a $220 million check to 35 states and the District of Columbia to settle allegations that it sold drivers' data to data brokers, who then sold it to insurance companies. The settlement, announced by Washington Attorney General Nick Brown, also forces GM to get drivers' express consent before it collects or shares their driving and location data going forward. The payout is the headline, but the real cost is the consent mandate. GM can no longer quietly bundle driving behavior and location into its connected services and monetize that data on the back end. Every state attorney general that signed on is now watching how GM implements that consent, and the rest of the auto industry is watching too.

For context, modern vehicles are rolling data collectors. Telematics systems track speed, braking, location, and other driving behaviors, and automakers have historically used that data for safety and maintenance. But the same data is valuable to insurers, who can use it to price premiums based on actual driving behavior. The states' complaint alleged GM sold that data to brokers without adequately informing drivers, and the brokers resold it to insurance companies. This settlement is part of a broader regulatory push. State attorneys general have been increasingly aggressive about data privacy, especially around sensitive location and behavioral data. Washington AG Nick Brown's involvement signals that this is not just a one-off fine; it's a template for enforcement against any company that monetizes consumer data without clear consent. The Federal Trade Commission has also been scrutinizing data brokers, and this settlement could give state AGs a playbook to use against other industries.

For GM, the $220 million is a significant but manageable cost for a major automaker, but the consent requirement is a structural change. GM's OnStar and connected services have been a growth area, and data monetization was a potential revenue stream. Now GM must redesign its data collection practices, likely adding friction to the user experience and potentially reducing the volume of data it can collect. That could slow its data-driven initiatives, from insurance partnerships to usage-based pricing. The bigger story is what this means for every automaker with a connected car. Tesla, Ford, Toyota, and others all collect similar data. If GM is forced to get express consent, consumers may start expecting the same from every brand. That could raise the cost of data collection across the industry and force automakers to be more transparent about what they collect and why. It also gives insurers a reason to be cautious about buying data from brokers, since the legal risk may now be higher.

For consumers, this settlement is a reminder that the car you drive is a data-generating device. The express consent requirement means you'll likely see more pop-ups and permission prompts in your vehicle's app or dashboard. That's a good thing for privacy, but it also means automakers may try to bundle consent into terms of service or make it a condition of using certain features. The states will be watching to ensure the consent is truly informed and voluntary. For executives in any industry that touches consumer data, the lesson is clear: if you collect it, you own the risk. The GM settlement shows that selling data to third parties doesn't insulate you from liability - the original collector is still on the hook. Boards should review their data monetization practices now, before a state AG does it for them. The cost of compliance is always cheaper than the cost of a settlement.