GM Pays $12.75 Million Over Driver Data It Sold to Other Companies

General Motors agreed to pay $12.75 million to settle a lawsuit brought by California officials. The state alleged that GM collected detailed information about how Californians drive — things like speed, braking habits, and where they go — and then sold that data to companies that buy and sell personal information, according to an announcement from the California Attorney General's Office.

The settlement came together with help from California's Attorney General, several district attorneys across the state, and the California Privacy Protection Agency. Beyond paying money, GM also agreed to stop selling driver behavior data and to limit how it uses that information going forward.

What GM Was Doing

California officials said GM broke two state laws: the California Consumer Privacy Act (CCPA), which became law in 2020, and the state's Unfair Competition Law. The CCPA gives Californians the right to know what personal data companies collect about them and the right to say no to having that data sold.

GM collected this driving information through its connected cars — vehicles that are linked to the internet and GM's services. The data included details like how quickly drivers accelerate, how often they brake, whether they speed, and their typical routes. Insurance companies and marketing firms wanted this data because it helps them understand who people are and what risks they pose.

What Has to Change for GM

The settlement includes strong restrictions on what GM can do with driver data. Most importantly, GM can no longer sell driving behavior information to data brokers — companies whose business is buying and selling personal data.

For a company like GM that makes billions of dollars a year, the $12.75 million fine is not huge. But the ban on data sales likely matters more. It closes off what appears to have been a real money-maker for the company. The settlement still needs court approval, which is standard for deals this large.

Why Automakers Want to Sell Your Driving Data

Modern cars are powerful computers on wheels. They collect constant streams of information through GPS systems, cameras, sensors, and diagnostic systems. For insurance companies trying to decide how risky a driver is, or for advertisers trying to figure out who you are, this data is valuable.

Automakers have been looking for new ways to make money as car sales grow tighter and the shift to electric vehicles costs them a lot. Selling data and providing connected services have become important money-making opportunities.

But the world of rules around data is changing. California's law is one of the strongest state privacy laws in the country, and penalties for breaking it can be expensive for big companies. The landscape in which automakers operate is getting stricter.

What This Means More Broadly

This is not the first time we have seen this pattern. When the internet became commercial in the 1990s, companies collected user data without many rules in place. Over time, privacy laws caught up, and companies had to change how they do business. The same thing appears to be happening with connected cars now.

As cars have become more sophisticated, government officials have paid more attention to what data they collect. Modern vehicles can track where you go, how you drive, even biometric information like facial recognition. This goes well beyond simple transportation facts.

Looking ahead, automakers will likely need to rethink how they make money from data. The settlement's restrictions may set a pattern that other states follow, which could shift what becomes the standard way the industry operates. The fact that multiple government agencies coordinated on this case suggests there may be more enforcement actions to come, possibly in other states.

What the Tech Side Looks Like

For the teams that build and run these car data systems, the settlement means they will need better tools to track what data they have, who it belongs to, and what they are allowed to do with it. They will need to be able to quickly change or delete information when someone asks, and stay in compliance with rules that keep changing.

Since GM cannot sell data to brokers anymore, it will need to find other ways to use that data to make money — perhaps by building its own advertising platform, working directly with insurance companies, or offering customers services they pay for. However it does this, the company will need to keep data privacy at the center of how it designs these systems from the start.