General Motors (GM) has agreed to pay $12.75 million to resolve allegations in California that it illegally sold the location and driving data of hundreds of thousands of its customers. California Attorney General Rob Bonta announced the settlement, stating that the Detroit-based automaker had provided "numerous statements reassuring drivers that it would not do so" before allegedly sharing their information with two data brokers.
The dispute centres on claims that GM vehicles, equipped with connected services, were collecting and transmitting sensitive personal data without adequate consent or in contradiction to stated privacy policies. This data, which included detailed location history and driving behaviour, was then reportedly sold on to third-party entities. The settlement, agreed upon last Friday, does not constitute an admission of wrongdoing by GM but resolves the claims brought against the company.
While this particular settlement is focused on the United States, it raises significant questions for UK motorists and the broader European data protection landscape. Modern vehicles are increasingly sophisticated, often incorporating extensive connectivity features that collect vast amounts of data, from navigation patterns to braking habits. This data can be highly valuable to insurers, advertisers, and other commercial entities, leading to growing concerns about how it is collected, stored, and shared.
For UK drivers, the case serves as a timely reminder of the importance of understanding the privacy policies associated with their vehicles' connected services. The UK operates under robust data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which mandate strict rules around the collection, processing, and sharing of personal data. These laws require explicit consent for data processing, transparency from organisations, and give individuals rights over their data.
The UK Government and regulatory bodies, such as the Information Commissioner's Office (ICO), are actively monitoring developments in data privacy across various sectors, including automotive. This US settlement could prompt further scrutiny of how car manufacturers operating in the UK handle driver data, potentially leading to updated guidance or enforcement actions to ensure compliance with British data protection standards. British consumers are encouraged to review the terms and conditions of their vehicle's connected services and understand what data is being collected and how it is used.