The Dashboard Was Selling You Out

General Motors has agreed to pay $220 million to settle claims that it sold driver behaviour data to insurance companies without proper consent. That is the headline. The more useful sentence is the one underneath it: this was not a leak, not a breach, not a rogue contractor. It was a product. Someone at GM decided that the braking patterns, acceleration habits and mileage logs of its customers were worth packaging and selling to LexisNexis and Verisk, who in turn sold risk scores to insurers, who then used those scores to adjust premiums or decline coverage. The car became a sensor network before anyone told the person behind the wheel what it was sensing for.

It is worth sitting with how ordinary this sounds once it is spelled out, because that ordinariness is the problem. Nobody at GM needed to break into a system or exfiltrate anything. The data was already flowing, by design, through features sold to customers as conveniences. Turning that flow into a commercial product for a third-party industry was simply a matter of signing a contract. The settlement exists because a court or regulator decided that contract was signed on terms the driver never properly agreed to, not because the underlying technical capability was itself illegitimate.

The Business Model Was the Problem, Not a Glitch in It

It is tempting to read a $220 million settlement as evidence of a mistake that got corrected. That framing lets the industry off too lightly. The data pipeline from vehicle to insurer was not an accident that slipped past legal review, it was a revenue stream designed and maintained over years. Connected car features, the kind marketed as conveniences, OnStar-style safety monitoring, remote diagnostics, usage-based insurance programmes, all depend on the same underlying capability: constant transmission of how a vehicle is driven. Once that capability exists, selling access to it is not a leap, it is the obvious next step for anyone running a balance sheet.

The settlement does not undo that logic. It prices one instance of it. Other manufacturers running comparable telemetry programmes have no reason, on the strength of this case alone, to assume their own arrangements are clean. A number like $220 million matters, but it matters as a data point about what got caught, not as proof the practice has stopped. If anything, it tells rival manufacturers roughly what the downside risk looks like, which is a very different thing from telling them to stop collecting the data in the first place.

There is also a quieter incentive problem buried in the structure of the deal itself. LexisNexis and Verisk are not car companies, they are data brokers whose entire commercial purpose is turning behavioural signals into risk scores that insurers will pay for. Their business does not depend on any one manufacturer's goodwill. It depends on access to data streams, wherever those streams originate. A settlement that constrains GM's specific conduct does very little to constrain the brokers sitting in the middle of the pipeline, and they are the ones with the strongest commercial motive to keep sourcing data from wherever they can get it.

Consent Was Treated as a Box to Tick, Not a Condition to Meet

The core allegation is not that GM collected data, it is that drivers did not meaningfully agree to have it sold onward to companies whose entire purpose is pricing risk against them. There is a difference between consent buried in a lengthy terms-of-service agreement accepted during a dealership sign-up, and consent that a driver actually understands and can decline without losing other features. The former is what much of the connected car industry has relied on. The latter is what regulators and now courts are increasingly saying the law requires.

This gap between technical consent and real consent is not unique to cars. But cars make the problem more visible, because the asymmetry is so stark: a driver has no practical way to audit what their own vehicle is transmitting, while the companies on the receiving end have built entire analytics businesses around interpreting it. Nobody signs up for a car assuming the dashboard is also a reporting mechanism to their future insurer. The asymmetry is not accidental either. A driver cannot easily check a log of what their vehicle has sent, when it sent it, or who received it. The infrastructure for transparency was never built, because transparency was never the point of the data pipeline, monetisation was.

It is also worth asking what "consent" even meant in practice for most of the drivers affected. Agreeing to a connected services package at the point of sale, often to unlock features the car was already capable of, is not the same as agreeing to have driving behaviour sold to an insurer. Folding the second into the first, buried somewhere in a document nobody reads in a dealership finance office, is exactly the kind of consent-by-exhaustion that regulators are now starting to treat as insufficient, however long it has been standard practice.

Other Parts of the Industry Are Running the Same Playbook on Oversight

It is worth noting how slowly scrutiny catches up with new technology across the wider motor trade, not just in data. The Motor Ombudsman has marked ten years in business this year, and it is reporting that AI is now driving dispute volumes, meaning the tools dealers and manufacturers adopt for efficiency are generating new categories of consumer complaint faster than existing frameworks can absorb them. Separately, the SMMT has called for "meaningful reform" of government EV targets, arguing that policy has not kept pace with the realities manufacturers face on the ground. Different problems, same shape: technology and targets move first, accountability structures follow years later, and the public absorbs the gap in between.

GM's data settlement fits that pattern precisely. The technology to collect and monetise driving data existed well before any enforcement action priced its misuse. The $220 million figure is not a deterrent calculated in advance, it is a penalty assessed after the fact, once the practice had already generated years of revenue and already shaped how insurers set premiums for drivers who never knew their own braking habits were part of the calculation.

None of this is confined to data brokering. It is simply the clearest version of a pattern that shows up whenever a new capability reaches the market faster than the rules meant to govern it. Dealers adopting AI tools are generating disputes the Motor Ombudsman has to classify from scratch. Manufacturers building EVs against government targets are discovering, after the fact, that the targets do not match what the supply chain can deliver. In each case, the correction arrives only once the consequences have already landed on someone, whether that is a confused customer, a frustrated manufacturer, or a driver whose insurance premium quietly went up for reasons nobody explained to them.

What a Settlement Actually Changes

A payment of this size forces attention, and it likely forces some contractual changes between GM, LexisNexis and Verisk. What it does not automatically do is give drivers a clear, simple way to know whether their current vehicle is transmitting data to a broker right now, or a straightforward mechanism to refuse that transmission without losing unrelated features. Until that exists as a standard, enforceable expectation across manufacturers, settlements like this one will keep functioning as a cost of doing business rather than a correction of it.

A genuine fix would look different from a fine. It would mean a driver being able to open a single screen in their own car and see, in plain terms, every third party currently receiving data from that vehicle, and a toggle to stop it without losing the ability to unlock the doors remotely or check the tyre pressure. Nothing in the settlement requires that. It requires a payment, which is a different and much weaker thing than a structural change to how the industry treats the data it has spent a decade quietly building the infrastructure to collect.

The dashboard was never just telling the driver something. It was telling someone else something about the driver, and charging for the privilege. That is the business model the $220 million settlement puts a price on. Whether it puts a stop to it is a separate question, and nothing in the settlement itself answers it.