Your Chevrolet Silverado has been snitching on you. Every time you accelerated too hard pulling out of a parking lot, every late night drive, every quick stop at the gas station. General Motors collected it all and sold the data to third party brokers for seven years without asking permission.
California's Department of Motor Vehicles announced this week that GM will pay a record setting $12.75 million penalty for violating state privacy laws by selling detailed driving behavior data from over 1.5 million vehicle owners between 2015 and 2022. The fine represents the largest automotive data privacy penalty in California history.
The data GM sold wasn't just basic information. The company transmitted real time location data, speed readings, acceleration patterns, and braking behavior to data brokers including LexisNexis and Verisk Analytics. These companies then packaged and resold the information to insurance companies, law enforcement agencies, and other buyers willing to pay for intimate details about how people drive.
California DMV Director Steve Gordon said the settlement "sends a clear message that we will hold automakers accountable for protecting consumer privacy." The violation centered on GM's failure to obtain explicit customer consent before selling their data, as required under the California Consumer Privacy Act.
GM drivers had no idea their vehicles were broadcasting their every move. The data collection happened automatically through OnStar and other connected vehicle services that customers thought were there for roadside assistance and navigation help. Instead, these systems functioned as sophisticated surveillance networks feeding information to corporate buyers.
Like this? Get the app: iOS | Android
The scope of surveillance extended far beyond what most car buyers could imagine. GM tracked not just where people drove, but how they drove. Hard braking events, rapid acceleration, speed over posted limits, and time spent driving were all recorded and monetized. Insurance companies used this data to adjust premiums and coverage decisions without customers knowing their own cars provided the evidence.
LexisNexis, one of the primary data buyers, operates what it calls a "telematics exchange" where driving behavior scores are calculated and sold to insurance companies. Verisk Analytics runs similar operations, turning real world driving into risk assessment products. Both companies profited from GM's data harvesting while drivers remained unaware their privacy was being sold.
A GM spokesperson said the company "is committed to protecting our customers' privacy and has already made changes to our data practices." The automaker ended its partnerships with data brokers in March 2024, months before the California settlement was announced. However, the company provided no details about what data might still be collected or how it could be used internally.
The settlement requires GM to implement new consent mechanisms and data protection measures for California customers. The company must now explicitly ask permission before sharing driving data and provide clear explanations about how the information will be used. Customers must also be given options to opt out of data collection entirely.
Other automakers likely face similar scrutiny as regulators examine how connected vehicles harvest and monetize customer data. Modern cars collect vastly more information than most owners realize, from cabin conversations picked up by voice activation systems to detailed maps of daily travel patterns. The GM settlement establishes that selling this data without clear consent violates state privacy laws.
The $12.75 million penalty represents roughly what GM might earn from data sales in a few months, raising questions about whether the fine creates sufficient deterrent effect. For a company with annual revenues exceeding $170 billion, the settlement may feel more like a cost of doing business than a punishment for betraying customer trust.
Sources: California Department of Motor Vehicles settlement announcement; GM corporate statement; California Consumer Privacy Act compliance requirements
