A $20 Million Business Just Cost General Motors Far More Than $20 Million

GM made $20 million selling driver data. One settlement alone cost 63.75% of it back.

In brief:

• General Motors sold OnStar customer driving and location data to LexisNexis Risk Solutions and Verisk Analytics between 2020 and 2024, earning approximately $20 million.
• The Federal Trade Commission finalized a 20-year consent order against GM in January 2026, banning data sales to consumer reporting agencies for five years.
• California authorities secured a record $12.75 million CCPA settlement with GM in May 2026 - the largest privacy penalty in the law's history.

For four years, General Motors ran what looked, on paper, like a straightforward secondary revenue stream. OnStar, the company's connected-vehicle service, tracked driving behavior, acceleration, hard braking, speed, and precise GPS location for millions of subscribers. GM sold that data to two data brokers, LexisNexis Risk Solutions and Verisk Analytics, who packaged it into risk scores and sold those scores to auto insurers. Over four years, the arrangement generated roughly $20 million for GM. Roughly 14 million vehicles were connected to OnStar domestically, though the sold data covered only a subset of those subscribers who had specifically enrolled in the Smart Driver behavior-scoring program.

Then the bill came due. And it came due in pieces, each one larger than the last.

Two separate governments, two separate bills

The reckoning arrived in two distinct waves. First came the Federal Trade Commission, which issued an administrative complaint against GM in January 2025 alleging deceptive geolocation collection occurring roughly every three seconds without meaningful consumer opt-in consent. That process concluded a year later, in January 2026, when the FTC finalized a 20-year consent order: a five-year ban on transferring location and driving data to consumer reporting agencies, plus ongoing transparency and consent requirements extending two decades into the future.

Then came California. State Attorney General Rob Bonta, working alongside the California Privacy Protection Agency and several county district attorneys, announced a $12.75 million civil settlement in May 2026 - the largest penalty ever assessed under the California Consumer Privacy Act. The settlement requires GM to stop selling driving data to consumer reporting agencies for five years, delete retained data within 180 days absent explicit consent, and report regular privacy assessments to multiple California authorities.

A four-year revenue stream met a single state settlement, and the settlement won by a wide margin.

— Marqstats Analyst Team

Why the math never actually worked

Run the numbers side by side and the picture is stark. GM's entire four-year data-broker business, spanning the full national customer base, generated approximately $20 million. California's settlement alone - covering only California residents, a fraction of GM's total OnStar subscriber base - cost $12.75 million. That single state's penalty consumed 63.75% of everything the business had ever earned nationwide, before accounting for the FTC's separate 20-year compliance obligations, legal costs, or the multi-district litigation the underlying practices also triggered.

This wasn't a close call financially, even setting aside the reputational and operational costs of a 20-year federal consent order. The revenue was modest by any large corporation's standards. The liability, once regulators actually looked closely, proved to be a multiple of it.

This wasn't unique to GM - the whole category collapsed

What makes this genuinely instructive rather than a one-off cautionary tale is that GM's experience wasn't isolated. Verisk Analytics, one of the two brokers GM sold to, terminated its own Driver Behavior scoring product entirely in mid-2024, after it generated less than $1 million in annual revenue - a product that had exposed the company to the same multi-district litigation and regulatory exposure GM faced, for even less upside. Otonomo, an independent vehicle-data platform, saw its valuation collapse from a prior $1.4 billion capitalization before completing a reverse merger with Urgent.ly at a steep discount. The pattern across all three cases is the same: modest revenue, outsized legal exposure, and eventual retreat.

The counter-argument: was this really predictable, or is this hindsight bias?

A fair objection is that this analysis benefits enormously from hindsight - in 2020, when GM began these data-sharing arrangements, the regulatory environment around connected-vehicle data was considerably less developed, and it's not obvious the company could have confidently predicted a $12.75 million state settlement and a 20-year federal consent order at the outset. This is a reasonable point. But the underlying economics of the arrangement, a relatively small revenue stream built on selling detailed personal location and behavior data at scale, carried inherent regulatory risk that should have been visible well before 2024, particularly once California's own privacy framework matured and state attorneys general began actively pursuing similar cases. The company chose to continue past clear warning signs, including a 2024 New York Times investigation that first exposed the practice publicly.

What this means for automakers and data-driven businesses

• Any automaker still operating comparable data-sharing arrangements should conduct an immediate legal review weighing current revenue against the demonstrated regulatory exposure GM, Verisk and Otonomo all faced.
• Legal and compliance teams should treat the FTC's 20-year consent order structure as a template for how future enforcement actions in this space are likely to be shaped.
• Track the federal SECURE Data Act's progress specifically, since a uniform national data-broker registry could either formalize compliant practices or further raise the bar for any secondary data monetization strategy.

What exactly GM had to give up beyond the money

The financial penalty is only part of the settlement's actual cost to GM. Under the California agreement, the company must delete any driving data it retains within 180 days unless it obtains affirmative, express consent from the consumer - a substantial data-management undertaking across what was likely millions of records. It must also formally request that LexisNexis and Verisk delete the data GM previously sold them, extending the cleanup obligation to third parties GM no longer controls. And it must develop and maintain an ongoing privacy program, reporting regular assessments to the California Department of Justice, the California Privacy Protection Agency, and district attorneys' offices across four counties - a recurring compliance cost that persists well beyond the one-time $12.75 million payment.

The federal consent order adds a parallel, even longer-running obligation: 20 years of ongoing transparency and consent requirements, a timeline that will outlast several product generations and multiple changes in GM's own executive leadership. Neither of these ongoing obligations shows up in the simple revenue-versus-penalty comparison, but both represent real, sustained operational cost.

The specific mechanism that made this a state law violation, not just bad PR

California's complaint rested on a specific legal theory worth understanding, since it's a template other states are likely to follow. Investigators found that GM's own privacy policy stated the company did not sell driving or location data, and that any disclosure for insurance purposes would occur only at a customer's direction. GM then sold the data anyway, without the disclosure the policy promised, and retained data beyond what was operationally necessary for OnStar's stated services - itself a separate violation under California law. This wasn't simply a company failing to anticipate a new regulatory standard; investigators characterized it as GM's practices directly contradicting the company's own stated privacy commitments to consumers, a distinction that likely made the case easier to prosecute and the penalty easier to justify at record-setting scale.

The full market picture

Marqstats' complete United States automotive data management market analysis, including the full regulatory enforcement timeline and a scenario forecast through 2029, is available in the linked report below.