GM pays $220 million in privacy settlement over data sharing

General Motors has agreed to pay a $220 million settlement to resolve allegations from 36 state-level jurisdictions that the automaker improperly shared drivers’ behavioral and location data with third-party brokers. The announcement, made on Thursday, October 29, highlights the growing financial and legal risks associated with the monetization of connected vehicle data, a trend that is reshaping how manufacturers view their digital assets.

What happened

The settlement addresses claims that General Motors collected driving information through its Smart Driver program and subsequently sold or shared this data with brokers. Some of these brokers supplied the information to insurance companies, meaning data collected from a consumer-facing service was used to influence financial decisions affecting those same consumers.

According to PYMNTS, the core issue was not merely the commercial value of the vehicle data, but the downstream impact of sharing it. The data was used in ways that extended beyond the original intent of the service, creating liability for the automaker. This case involves 36 different state jurisdictions, indicating a broad regulatory and legal consensus on the impropriety of the data sharing practices.

• Settlement Amount: $220 million
• Parties Involved: General Motors and 36 state-level jurisdictions
• Data Type: Driver behavioral and location information
• Program: GM’s Smart Driver program
• Third Parties: Data brokers, including suppliers to insurers

Why it matters for the industry

This settlement serves as a cautionary tale for the broader manufacturing and technology sectors. As physical products become "connected," they generate continuous streams of operational, behavioral, and location data. While this data can support subscription services, predictive maintenance, and new commercial partnerships, it also introduces significant regulatory exposure.

Philip Yannella, co-chair of the privacy, security and data protection practice at Blank Rome, noted to PYMNTS that the volume of data-related litigation is rising sharply. "In 2021, there were 400 data breach lawsuits filed," Yannella said. "Last year, there were over 2,000." This surge suggests that data privacy is no longer a niche legal issue but a central financial risk for companies that rely on connected products.

The implications extend beyond automobiles. Industrial machinery, smart appliances, and connected medical or agricultural equipment all generate valuable data. However, every additional intermediary in the data chain introduces questions about consent, permitted use, and downstream accountability. Unlike a defective physical part, problematic data practices can affect millions of customers simultaneously across multiple jurisdictions.

What it means for investors and consumers

For investors, this settlement signals that the "connected product" business model carries hidden liabilities. The ability to collect data no longer guarantees the ability to profit from it without significant compliance costs. Companies that have built revenue streams around selling customer behavior data may face similar legal and financial headwinds. Investors should look for companies that are integrating privacy compliance into their core financial planning rather than treating it as an afterthought.

For consumers, the news reinforces the importance of understanding how their data is used. The GM case shows that data collected for one purpose (such as a driver assistance program) can be repurposed for another (such as insurance underwriting) without clear consent. This has prompted competitors to act; Ford Motor Company introduced a new Privacy Promise on Monday, November 2, pledging not to sell customers’ driving-behavior data to brokers and providing clearer information about data collection and control.

As discussed in our analysis of how privacy rules will shape AI competition, regulatory frameworks are increasingly determining which business models are viable. The GM settlement is a concrete example of these rules impacting traditional manufacturing revenue streams.

What happens next

The automotive industry is likely to see a shift in how data is monetized. Rather than selling raw customer behavior data to brokers, manufacturers may pivot toward selling services powered by that data, such as enhanced safety features or maintenance alerts, while retaining control of the underlying information. This approach preserves commercial value without surrendering control of the data.

For manufacturing CFOs, the focus is shifting from how much data their products generate to how much economic value they can retain without incurring excessive legal and compliance costs. The "risk-adjusted revenue" of connected data will become a key metric, reflecting the costs of privacy, compliance, and third-party liabilities. Companies that fail to account for these costs in their financial models may find that their data assets become liabilities that outlast their profitability.

Sources

• Manufacturing Data is Valuable. GM’s $220 Million Privacy Settlement Shows It’s Also Costly — pymnts.com