California Brings GM Telemetry with an Agreement of 12.75 Million for the Sale of Driver Data

The California Attorney General's Office reached an agreement on $12.75 million with General Motors that marks a turning point in the regulation of vehicle telemetry: state authorities concluded that GM, through its OnStar service and the "Smart Driver" program, collected and sold data on the driving and location of California residents to intermediaries such as Verisk and LexisNexis without the notification and consent required by State law.

Beyond the amount - a record in civil fines for privacy in California - the case is relevant because it is the first state compliance action specifically focused on the rule of Data minimization: that is, companies should only collect and retain what is strictly necessary for the stated purpose. The agreement requires GM to stop selling these data for five years, to ask buyers to delete the information already transferred, and to remove the records it retains within 180 days unless consumers give explicit consent for its preservation.

The case confirms a trend that we have seen in the automotive industry and in the data ecosystem: connected vehicles generate valuable information - precise positions, travel patterns, driving behaviour - that can be quickly monetized and end up in driver score products or profiles sold to insurers and other actors. This poses specific risks to people's privacy and physical security, from the identification of daily routines to the possibility of discriminatory use or unchecked commercial surveillance.

For the sector, the lesson is clear: the monetization of telemetry is no longer a grey ground without consequences. Federal and state regulators have intensified monitoring; in this case, the California ruling is in addition to previous sanctions and restrictions of the Federal Trade Commission and other research on data corridors. Companies operating with vehicle data need to incorporate privacy by design, review contracts with third parties and document legal bases and time limits for data retention.

For consumers, the agreement offers practical tools and reminders. Those with connected vehicles should review privacy policies and telemetry options in their manufacturer accounts or services such as OnStar, request data removal and exercise rights under California law (including the right to choose not to sell) where appropriate. The California Attorney General explains how to file complaints and understand these rights in his official note: communiqué from the Office of the Prosecutor-General.

For further information, there are journalistic and technical coverage of the case history and its impact on data corridors and insurers; an accessible and up-to-date summary of the research is available on BleepingComputer: analysis of the agreement. It is also recommended to read the manufacturer's privacy policies to identify how data are collected and used: for example, GM's global privacy statement provides guidelines on options and contacts for privacy requests: GM Privacy.

In regulatory and market terms, expect more control over the relationship between manufacturers, telematics providers and data corridors. Regulators are beginning to apply sanctions for practices that previously remained commercially "acceptable"; the priority now is to demonstrate that collection has a legitimate, proportionate and transparent purpose. For companies, investment in compliance and independent audits will no longer be an optional cost and will become an operational requirement.

Finally, as a specific recommendation: if you have a modern vehicle with connectivity, check your contract and the associated app, disable functions you do not need, document any removal requests you make and keep proof. If you live in California and believe that your rights have been violated, consult the state complaints and, if appropriate, bring the complaint to the competent authorities. The precedent of this agreement shows that privacy in the connected car age is an active regulatory border and that both consumers and companies need to adapt.