General Motors agreed to pay $12.75 million in civil penalties for selling driving data of hundreds of thousands of California motorists to data brokers, allegedly without their consent. General Motors misled drivers who paid for the emergency roadside and navigation service OnStar and made approximately $20 million from the unlawful sale of their data between 202
# THE TAKE: GM's Penalty Is Regulatory Theater General Motors just got cheap. Twelve-point-seven-five million dollars sounds massive until you remember GM's annual revenue eclipses $120 billion. That's a rounding error masquerading as accountability. Here's what actually happened: California's attorney general extracted a fine small enough that GM's cost-benefit analysis still favors data extraction. They monetized hundreds of thousands of drivers' intimate behavioral data—where you went, when, how fast—then paid less than 0.01% of annual revenue when caught. The real villain isn't GM's greed; it's the penalty structure itself. California designed a system where corporations can treat privacy violations as a business expense, not an existential risk. Until fines threaten *actual* profitability or executives face criminal liability, these settlements function as licensing fees. GM will keep selling your data. They'll just lawyer up better next time.
What the Documents Show
Instead, GM systematically harvested their precise location data, speed records, and driving patterns, then sold this intimate information to data brokers. The company misled subscribers about what would happen to their information, a critical distinction that transforms this from a privacy breach into deliberate deception. What makes this case particularly significant is the gap between the penalty and the profit. GM extracted roughly $20 million in value from illegally harvested data but paid only $12.75 million in civil penalties. Financially, the company came out ahead—a math that creates perverse incentives for other corporations considering similar schemes.
Follow the Money
The mainstream coverage of this story has largely treated it as a routine settlement, the cost of doing business, rather than highlighting the asymmetry at its core: breaking privacy law proved more profitable than respecting it. California's aggressive enforcement through its Attorney General stands in sharp contrast to the federal regulatory vacuum. The FTC has nominal authority over corporate data practices, but lacks the resources and political will to pursue cases at scale. GM faced consequences only because California maintains its own privacy enforcement apparatus—a protection unavailable to residents of the other 49 states. This jurisdictional reality means motorists in Texas, Ohio, or Florida driving identical GM vehicles with OnStar services received no legal protection whatsoever, despite engaging in identical transactions with the same company. The settlement also obscures an uncomfortable truth about connected car technology that the industry prefers unstated: vehicle data has become more valuable than the vehicles themselves.
What Else We Know
Modern cars are essentially moving data collection platforms. OnStar's primary value proposition to GM was never roadside assistance; it was the surveillance infrastructure embedded in millions of vehicles. Drivers who believed they were purchasing a service were actually selling their mobility patterns to the highest bidder, a transaction they neither consciously made nor understood. For ordinary people, the implications are chilling. If you own a connected vehicle—whether through OnStar, Tesla's telematics, or similar services in nearly every modern car—your driving behavior is likely already commodified. You have limited transparency into which data brokers possess your information, limited ability to delete it, and limited recourse if it's misused for insurance discrimination, targeted advertising, or sold to third parties you'd never willingly consent to.
Primary Sources
- Source: r/privacy
- Category: Corporate Watchdog
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.
This article is produced by NewsAnarchist's AI reporting system, not a human staff reporter. It's built from the primary source cited above (a FOIA release, an agency's own policy or procurement document, court filings from surveillance litigation, or the wire reporting linked in the body) and reports what that source states, attributed to it — it does not allege intent behind a surveillance program beyond what the record shows. Part of our Surveillance State hub. Found an error? Tell us.