GM cracks the petty cash box for multistate driver tracking settlement

General Motors collected granular driver data — including precise location and driving behavior metrics — and sold it to data brokers and insurance companies without meaningful consumer consent. GM compounded the violation by incentivizing dealerships to silently enroll customers and actively misleading drivers about their enrollment status, stripping them of any real opportunity to opt out. This case illustrates how organizations can weaponize consumer data for commercial gain while circumventing the foundational privacy principles of transparency, consent, and purpose limitation. The $220 million price tag demonstrates that regulators are increasingly willing to impose significant financial consequences for data monetization schemes that bypass consumer rights. Any organization that collects, processes, or shares personal data must treat consent and disclosure as legal obligations, not optional courtesies.