GM agrees to pay $220 million over driving data sales

What happened

General Motors has agreed to pay $220 million to settle claims that it sold drivers' driving habits and location information to data brokers. The settlement, first reported by Reuters and covered by The Verge, resolves a complaint brought by a coalition of 36 US attorneys general.

As part of the agreement, GM must limit the driving data it collects and obtain "express consent" from drivers before that data is used. The case centres on connected-vehicle data, which is generated automatically as a car is driven and can be shared well beyond the vehicle itself.

Why it matters

The case shows how consent works in connected products. When data is collected passively through a car's systems, the customer may not notice the collection at all, so the consent request becomes the main moment of transparency. Regulators are now treating that moment as a design problem as well as a legal one. A consent screen that is hard to understand, or buried in setup, does not meet an "express" standard, however much paperwork sits behind it.

For leaders in digital transformation, the settlement is a reminder that data governance has to be built into product and service design from the start. Connected hardware, apps and software are now sold as one service, and each data flow affects customer trust. Organisations that treat data use as a late-stage compliance task are likely to face the same kind of scrutiny.

By the numbers

• $220 million is the amount General Motors has agreed to pay to resolve the claims.
• 36 US attorneys general make up the coalition whose complaint the settlement resolves.

The Renascence take

Most coverage will focus on the penalty. The more useful question is why a driver would ever be surprised that their car reports on them. Behavioural economics explains it: people accept defaults, and they rarely read consent language that is designed to be skimmed.

The real failure here is not a missing checkbox but a choice architecture that treats the customer as the product. Consent should be a genuine decision, with a clear explanation of what is collected, who receives it and what the driver gets in return. Operators who want to avoid a settlement like this should audit every data flow in their connected products, switch off non-essential collection by default, and make the opt-in as easy to understand as the feature it unlocks.