General Motors has agreed to pay $220 million to resolve claims by a coalition of 36 US attorneys general that it sold or shared driver and location data through a driving-behaviour programme without proper consent. While the case is in the US automotive market, it has broader relevance for European businesses that collect behavioural, location or device data and share it with external partners.

What happened

According to reporting by Reuters, cited by The Verge, the settlement addresses allegations linked to GM’s discontinued Smart Driver programme. The programme reportedly collected information such as acceleration, braking and trip length. Authorities alleged that this data was passed to data brokers, which in turn enabled insurance companies to buy and use the information.

Under the agreement, GM will pay $220 million and must limit the driving data it collects. The settlement also requires the company to obtain express consent from drivers before collecting their information. The reported allegations concern driver and location data, both of which can be commercially sensitive and legally significant when linked to individuals.

Why it matters for European businesses

The case is a reminder that data collected through connected products, apps, websites and platforms can create serious legal, commercial and reputational exposure when businesses share it beyond the original service context. For European companies, the practical lesson is not limited to automotive data. Similar issues can arise in telematics, e-commerce, mobile apps, marketing technology, SaaS platforms, workplace monitoring and IoT deployments.

For businesses operating in Europe, the central issue is not only whether data can be collected, but also why it is collected, how clearly users are informed, whether consent is valid where required, and what happens when data is shared with third parties such as brokers, analytics vendors, insurers or ad-tech partners.

The GM settlement is also relevant because regulators and courts are increasingly focused on data practices that may be technically disclosed in contracts or settings, but not explained in a way users would reasonably understand. That matters for companies using behavioural data to support pricing, profiling, risk scoring, targeting or automated decision-making.

Who may be affected

• Connected product providers: companies selling vehicles, devices, wearables, industrial equipment or smart products that generate behavioural or location data.
• E-commerce and app businesses: organisations collecting granular customer activity data across apps, loyalty programmes or digital services.
• Marketing and martech teams: businesses using third-party analytics, enrichment, attribution or audience platforms that depend on user-level data sharing.
• Insurtech, mobility and telematics firms: companies handling driving, usage or movement data that may influence pricing or risk assessment.
• IT and compliance teams: teams responsible for consent mechanisms, vendor management, data mapping and privacy governance.

What companies should consider

• Review consent flows: check whether behavioural and location data collection is explained clearly and whether any consent mechanism is specific, informed and separate from general terms where necessary.
• Map third-party data sharing: identify which partners receive customer, user or device-level data, for what purpose, and whether those transfers match what users were told.
• Limit collection to defined purposes: assess whether all collected data is necessary for the service provided, especially when it could later be used for profiling, scoring or resale.
• Examine broker and partner relationships: businesses should understand whether downstream recipients can combine, resell or repurpose data in ways that create legal or reputational risk.
• Strengthen governance for sensitive data types: location, behavioural and usage data can become high-risk when connected to individuals, accounts or financial outcomes.
• Align product, legal and marketing teams: privacy risks often arise when data collected for product functionality is later reused for analytics, advertising, partnerships or commercial models.

Although this settlement was reached in the US, the underlying issue is familiar globally: businesses that collect detailed user data need clear governance, transparent disclosures and robust controls over third-party use. For European companies, especially those building connected services and data-driven business models, this is a practical warning that data monetisation strategies can quickly become a compliance and trust issue.