GM’s $220 Million Privacy Settlement: What Drivers Need to Know
TL;DR
- GM reportedly agreed to a $220 million settlement over claims that driver-behavior and location data were collected or shared without sufficiently clear permission.
- The dispute centers on whether consent buried in vehicle, app, or OnStar terms meets the legal standard for express, informed authorization.
- The case could push automakers toward clearer opt-in controls, narrower data collection, and stronger limits on sharing connected-car information.
A connected car can reveal far more than where a vehicle is parked. It may record trips, destinations, speeding or hard-braking events, mileage, driving hours, and other behavioral signals. Automakers can use that information to operate safety and navigation features, personalize services, assess vehicle performance, or support insurance-related products.
But the same data can also create a detailed record of a person’s movements and habits. That is at the center of allegations involving General Motors and its connected-vehicle data practices.
The reported $220 million settlement would resolve claims that GM collected or shared drivers’ private driving and location information without obtaining adequate permission. The agreement does not necessarily mean GM admits wrongdoing; settlements typically resolve litigation while allowing the defendant to deny liability. Its practical importance, however, extends beyond the payment itself. The case highlights a growing legal question for the automotive industry: What does meaningful consent look like when a vehicle constantly generates personal data?
What the dispute is about
The allegations focus on data associated with GM’s connected-vehicle ecosystem, including services such as OnStar and related vehicle-connectivity features. Depending on the vehicle, service plan, and customer settings, connected systems may process information about location, trip history, mileage, vehicle operation, and driving events.
The information can be valuable. It may help provide roadside assistance, emergency response, theft recovery, maintenance alerts, navigation, and other services. Automakers also have an interest in using aggregated or individual-level data for analytics and commercial partnerships.
The legal challenge is whether drivers understood that this information was being collected and where it might go. Plaintiffs have argued that disclosures and consent mechanisms were not sufficiently clear, prominent, or specific, particularly when data was later made available to outside companies or used in contexts that drivers did not expect.
The central question is not simply whether a privacy policy existed. It is whether drivers received understandable information and made a genuinely informed choice before their data was collected or shared.
Why express consent matters
Privacy law generally distinguishes between passive notice and affirmative permission.
Passive notice may involve a privacy policy, terms-of-service document, or disclosure presented during vehicle activation. A company may argue that a customer accepted those terms by purchasing a vehicle, enrolling in a service, downloading an app, or continuing to use a connected feature.
Express consent is a stronger standard. It usually requires a clear explanation of what data will be collected, why it is needed, how long it may be retained, and whether it will be shared with third parties. The user must then take an affirmative action, such as selecting an opt-in box or enabling a clearly described feature.
The difference is especially important for driving data. A customer may reasonably expect an emergency-response service to know a vehicle’s location while that service is active. The customer may not expect a record of ordinary trips or driving behavior to be shared with an insurance-data company, lender, employer, or other commercial partner.
A lengthy disclosure can technically mention data sharing without giving consumers a meaningful choice. Regulators and courts are increasingly examining whether consent was understandable, timely, and connected to the specific use at issue.
What information may be at stake
Connected-vehicle data can include several categories of information:
Location history: Where a vehicle traveled, stopped, or remained parked.
Trip details: Start and end points, route patterns, duration, distance, and time of travel.
Driving behavior: Events such as hard braking, rapid acceleration, speeding, sharp turns, or other telematics signals.
Vehicle identifiers: The vehicle identification number, account details, device identifiers, and information associated with a particular driver or household.
Usage and service data: Mileage, maintenance information, remote commands, diagnostic information, and interaction with connected services.
Even when a data set does not contain a person’s name, repeated location records can often be linked back to an individual. Trips between a home, workplace, school, medical facility, religious institution, or political organization may reveal sensitive personal information.
The risks are amplified when driving records are combined with other databases. A data broker or analytics company may be able to connect vehicle information with identity, credit, insurance, property, or public-record information.
The insurance-data controversy
One reason the GM dispute attracted attention is the alleged connection between driving-data collection and insurance-related decision-making.
Telematics information can be used to offer usage-based insurance, in which premiums are influenced by how, when, and how much someone drives. In principle, this can benefit cautious drivers. But drivers may face higher rates or difficulty obtaining coverage if insurers receive data they did not realize was being collected.
The controversy raises several questions:
- Did the driver intentionally enroll in an insurance or safety program?
- Was participation required to activate another vehicle feature?
- Was the data shared in a form that could identify the driver?
- Did the driver understand that the information could affect insurance decisions?
- Could a customer withdraw consent and have previously collected data deleted?
These questions make automotive privacy different from ordinary website tracking. A driver may not have a practical alternative to using the vehicle’s built-in connectivity, and some features may be integrated into the car rather than offered as a separate online service.
What the settlement could require
The precise obligations depend on the final settlement documents and any court approval. A settlement of this kind may include some combination of monetary payments, changes to disclosure practices, revised consent procedures, limits on data sharing, deletion or retention requirements, and a process for consumers to access or control their information.
Potential changes could include:
Clearer privacy notices: Automakers may need to explain data practices in plain language rather than relying primarily on long, legalistic policies.
Separate opt-ins: Consent for emergency services, navigation, diagnostics, marketing, and insurance-related uses may need to be presented as distinct choices.
Easier opt-outs: Drivers could receive more practical ways to disable optional collection or withdraw permission through an app, website, or customer-service channel.
Data minimization: Companies may be expected to collect only the information necessary for a specific feature and retain it for no longer than needed.
Limits on secondary use: Data collected to provide roadside assistance, for example, may not automatically be available for unrelated commercial purposes.
Better records of consent: Automakers may need to document when, how, and for what purpose a driver gave permission.
The agreement’s actual impact will depend on its definitions. A settlement may distinguish between data required for core safety or vehicle functions and data used for optional analytics, advertising, or insurance services.
What drivers should do now
Drivers who own a connected GM vehicle should review their account, OnStar settings, mobile-app permissions, and vehicle privacy controls. The exact options vary by model, model year, service plan, and region.
Drivers should look for settings or notices related to:
- Vehicle location and trip history
- Driving-behavior or “Smart Driver” features
- Insurance or telematics programs
- Third-party data sharing
- Personalized marketing
- Emergency and roadside services
- Data access, deletion, and retention
Turning off optional data sharing may disable some connected features. Emergency assistance, stolen-vehicle services, remote commands, navigation, diagnostics, and other functions may depend on connectivity. Before changing settings, drivers should check which services will be affected.
Consumers should also save copies of privacy notices, consent screens, account settings, and communications about data sharing. Those records may be useful if a claims process opens or if a driver wants to challenge an unexpected insurance or privacy decision.
The broader legal landscape
The GM case is part of a larger shift in how regulators and courts view data from cars.
Automobiles have traditionally been treated as physical products. Connected vehicles are also software platforms with sensors, cellular connections, cloud accounts, and third-party integrations. That creates overlapping legal issues involving consumer privacy, data security, unfair business practices, biometric and location information, and insurance regulation.
Federal regulators have already shown interest in connected-car privacy. State attorneys general and state privacy regulators have pursued cases involving vehicle data, while lawmakers have proposed broader rules governing the sale and sharing of information generated by cars.
California and other states with comprehensive privacy laws give consumers rights that may include access, deletion, correction, and opting out of certain data sales or targeted advertising. Whether those rights apply in a particular situation depends on the company, the type of data, the consumer’s location, and the purpose for which the information is used.
The legal environment remains fragmented. A practice permitted in one jurisdiction may face restrictions in another, and automakers may ultimately adopt nationwide standards to avoid maintaining different data systems and consent processes for different states.
Why this matters for the entire auto industry
GM is not the only automaker collecting connected-car information. Virtually every major manufacturer now offers vehicles that communicate with cloud services, smartphone apps, navigation providers, roadside-assistance networks, and other outside platforms.
The settlement could therefore influence industry norms in several ways.
First, automakers may move away from bundled consent. Instead of asking customers to accept a single broad policy, companies may offer separate choices for safety, convenience, analytics, marketing, and commercial partnerships.
Second, data-sharing arrangements may receive closer scrutiny. Automakers may need to evaluate whether vendors are using information only for the service originally described and whether they can resell, enrich, or retain it.
Third, vehicle interfaces may become more important. Privacy choices presented on a phone or website may not be enough if the relevant decision occurs when a person buys, leases, or first activates a vehicle. Regulators could expect the consent experience to be visible and understandable at that moment.
Finally, the case may affect the economics of automotive data. Data has become a potential source of revenue for automakers, insurers, advertisers, and analytics companies. Stronger consent requirements could reduce the amount of information available for secondary uses and make those partnerships more expensive to operate.
Questions that remain unanswered
The settlement does not by itself resolve every question about connected-vehicle privacy.
It may not establish a universal rule for all automakers or all data uses. It may also leave open difficult issues involving leased vehicles, multiple drivers, used-car buyers, household accounts, rental cars, and vehicles sold after a customer has consented to data collection.
Another unresolved issue is ownership. Consumers often ask whether they “own” the data produced by their vehicles. In practice, the more immediate questions are who controls the information, who can access it, who may use it, and what rights consumers have to limit or delete it.
The treatment of de-identified data is also likely to remain contested. Companies may describe data as anonymous after removing names and direct identifiers. Privacy advocates argue that detailed location and driving patterns can often be reidentified, especially when combined with other information.
The future of automotive data collection
The GM settlement underscores a basic principle: connectivity does not eliminate the need for consent.
Drivers may accept that a vehicle needs some information to provide emergency or diagnostic services. They may be less willing to accept broad, indefinite collection of their movements and driving habits for purposes they never knowingly selected.
The industry’s next phase will likely involve more explicit permission requests, more granular settings, shorter retention periods, and greater transparency about third-party sharing. Automakers that make those choices easy to understand may build more trust with customers. Those that rely on buried disclosures or bundled consent could face additional lawsuits and regulatory action.
For drivers, the practical lesson is straightforward. A connected vehicle is also a data-collection device. Before activating optional services, consumers should determine what information is being gathered, why it is needed, who receives it, how long it is kept, and whether saying no will affect essential vehicle functions.
The reported $220 million settlement may resolve one major dispute, but the debate over who controls the information generated by modern cars is only beginning.
Get All The Latest Updates Delivered Straight To Your Inbox For Free!