GM agrees to pay $12.75M to resolve a California investigation into claims that it illegally sold the location and driving data of OnStar subscribers to brokers
GM (GM.N) has agreed to pay $12.75 million to resolve a California investigation into allegations that the Detroit automaker illegally sold …
Context & Ripple Effects
The California resolution follows GM's 2024 decision to stop sharing driving data with two brokers after reporting raised questions about consent. It also comes after the FTC barred GM from selling driver-behavior and geolocation data to consumer-reporting agencies for five years.
The related coverage shows the issue has moved from a disclosure-and-consent controversy to overlapping federal and state enforcement, making connected-car data practices a material compliance issue for GM and OnStar.
First-order effects
- GM will pay $12.75 million to resolve California's investigation, adding a state-level penalty to the restrictions already imposed on its handling of driver data.
- OnStar's collection and sharing practices face greater scrutiny, with GM needing to demonstrate that subscriber consent and downstream data use meet regulatory requirements.
Second-order effects
- Other automakers and connected-vehicle service providers will face pressure to audit broker relationships, consent flows, and any use of location or driving-behavior data.
- Data brokers and consumer-reporting channels lose a potentially valuable vehicle-data source as enforcement makes automaker-supplied behavioral and location data riskier to acquire and use.
Third-order effects
- If state and federal actions continue to converge, connected-car data may be governed less as a product feature and more as a regulated consumer-data category, with clearer limits on resale and secondary use.
- The episode reinforces a broader trade-off for automakers: data-enabled services can support product development, but weak consent practices can create enforcement exposure that outweighs the value of monetization.
The trend: Connected vehicles are becoming a new privacy-enforcement frontier as regulators test whether automakers' data-sharing models provide meaningful driver consent and adequate limits on resale.