GM Charged $12.75 Million for Knowing Where You Were Going

There's a version of the connected car pitch that sounds reasonable. Better navigation. Smarter maintenance alerts. A vehicle that learns your habits and makes the drive easier. That was always the sales line. The fine print, apparently, read differently.

General Motors has agreed to pay $12.75 million to settle with a coalition of law enforcement agencies led by California Attorney General Rob Bonta, after allegations that the company sold customer location and driving data to data brokers — conduct that reportedly violated California's privacy and anti-competition laws. Both TechCrunch and MotorBiscuit covered the settlement. Neither needed to editorialize much. The facts do the work.

What the Car Already Knew

Think about what a modern vehicle actually collects. Where you go. When you leave. How fast you drive. How hard you brake. The routes you repeat. The stops you make. The patterns that, taken together, describe a life more accurately than most people would describe themselves. That data lives in the car. Or rather — it lived in GM's servers. And according to the allegations, it moved from there to brokers who paid for it.

This wasn't a breach. Nobody hacked anything. The data moved through channels that existed because someone built them. That's the part that should stay with you.

The settlement involves a group of law enforcement agencies, which tells you this wasn't one regulator having a bad week. California led it, but the coalition suggests the concern was broad. Twelve and three-quarter million dollars is real money. It's also, for a company the size of GM, a number that gets absorbed without restructuring anything. The question is whether it changes behavior or just prices it.

The Model Was Always the Message

The auto industry sold connectivity as a feature. Heated seats were a feature. Bluetooth was a feature. Over-the-air updates — genuinely useful — are a feature. But somewhere in the architecture of the modern connected car, the driver became part of the product stack. Not maliciously, maybe. But deliberately. Data collection at this scale doesn't happen accidentally. It requires infrastructure, agreements, and someone deciding the asset is worth monetizing.

What GM allegedly did wasn't unique to GM. It was a logical extension of how Silicon Valley taught an entire generation of industries to think about their users. If you have data and someone will pay for it, the question becomes: why wouldn't you? The answer — because the person who generated that data didn't agree to the transaction — got treated as a compliance problem rather than a moral one.

California's privacy laws exist precisely because that calculus kept winning. The settlement suggests those laws have teeth, at least occasionally. But a $12.75 million penalty extracted after the fact doesn't undo the selling. It just sets a price on having done it.

The thing I keep returning to is the gap between what drivers thought they were consenting to and what was apparently happening. Most people click through terms of service the way they drive past speed limit signs — present but not processed. The automakers knew this. The data brokers knew this. The whole arrangement depended on it.

The connected car was supposed to serve the driver. Somewhere along the way, the driver became the inventory.