GM settles for $220 million after selling driver data without proper consent

When the consent records aren't there

General Motors has agreed to pay $220 million to settle allegations from 36 US state attorneys general that it unlawfully sold detailed driving data from more than 1.8 million vehicles to insurance data brokers without obtaining proper consent from drivers ^[1]. The data included harsh braking, acceleration, speed and time of day, collected through the vehicles' OnStar Smart Driver feature.

The settlement requires GM to delete the data it collected, obtain explicit opt-in consent before sharing driving data with third parties in future, allow drivers to withdraw consent at any time and submit to independent monitoring for 20 years ^[1]. It's one of the largest privacy settlements involving connected vehicles.

Think of it like this: say your phone's fitness app sold your step count and heart rate to health insurers, and when you complained, the company couldn't show you ever agreed to it. That's roughly what happened here, except the data came from your car and some drivers saw their insurance premiums go up as a result ^[2].

The states alleged that GM's consent mechanisms were unclear, buried in long privacy policies or tied to unrelated services. In some cases, drivers who thought they were signing up for roadside assistance or vehicle diagnostics found their driving habits being shared with data brokers who then sold scored profiles to insurers ^[2].

What GDPR says about consent and records

Under the EU's General Data Protection Regulation, which has applied since 25 May 2018, organisations that rely on consent as their lawful basis must be able to demonstrate that consent was given ^[3]. The consent must be freely given, specific, informed and unambiguous, and the person must be able to withdraw it as easily as they gave it.

Article 7(1) states: "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data" ^[3]. That means keeping a record of when consent was obtained, what was shown to the person and what they agreed to.

Article 17 gives people the right to have their data erased in several circumstances, including when they withdraw consent and there is no other lawful ground for keeping it ^[3]. A company that can't show what consent covered, or when it was withdrawn, is in a weak position when a regulator or a court asks the question.

In the GM case, the attorneys general argued that drivers were not given clear, standalone choices about data sharing, and that GM could not adequately demonstrate valid consent for the processing that took place ^[1]. The scale of the penalty and the 20-year monitoring requirement suggest the authorities viewed the failures as serious.

The proof problem: showing consent was lawful

Consent records are often kept in databases that the same organisation controls. A year or two after someone signed up, the question becomes: can you show what the consent form said at the time, that the person actually saw it and ticked the box, and whether they later withdrew it?

If the only record is an editable database entry that says "consented: yes, date: 12 March 2023", and the person says they never agreed or that the form didn't explain data sharing, it's your word against theirs. When hundreds of thousands of people are involved, as in the GM case, the lack of contemporaneous, unchangeable records becomes a material risk.

The attorneys general pointed to complaints from drivers who said they had no idea their data was being shared, and to gaps in GM's documentation of what consent was obtained and when ^[2]. The settlement's requirement for deletion suggests GM could not prove a lawful basis for keeping the data.

What this means for you

If your organisation collects consent for data processing, especially at scale, here are some practical questions:

• Can you show exactly what consent text someone saw two years ago, if they dispute it?
• Do you have a record of when consent was given, and by whom, that nobody inside the organisation can quietly edit?
• If someone withdraws consent, can you prove the withdrawal was honoured and when?
• Could you demonstrate to a regulator that consent was freely given, not bundled with something unrelated?

The GM settlement shows that "we think we had consent" isn't enough when the penalties run into hundreds of millions and the monitoring lasts for decades. The safeguard is in the records you keep at the time, not in what you reconstruct later.

Sealing consent records as they happen

This is a case where a digital witness fits the problem directly. The thing to seal is the consent record as it is captured: what the person saw, what they agreed to, the timestamp and, if relevant, the identifier that links it to them. Sealing takes a fingerprint of the record, not the record itself, so the personal data never leaves your systems.

You seal it when consent is given. If the person later withdraws consent, you seal that event too. The witness doesn't decide whether the consent was valid or whether you honoured a withdrawal, but it does let you show that the record you have now is exactly what was written at the time, unchanged.

Anyone you share the record with—a regulator, an auditor, your own legal team—can check that it matches the sealed fingerprint. It doesn't require them to trust you, or to trust a third party who might have an interest in the outcome. They just compare the fingerprints.

What it doesn't do: it doesn't make consent lawful if it wasn't, it doesn't replace your obligations under Article 7 or Article 17, and it doesn't prove the person actually read what they agreed to. It shows that the record is the one created at the time, which is often the question you need to answer when something is challenged.

You can seal consent records through WitniumChain's REST API, SDK or MCP server. The content stays with you. The first 2,000 witnesses a month are free. Full documentation is at witniumchain.com/docs.

How it would work

1. When someone gives consent, your system captures the record (consent text shown, timestamp, user identifier, IP address if relevant) and sends a fingerprint to WitniumChain.
2. WitniumChain returns a witness ID. You store that alongside the consent record.
3. If the consent is later questioned, you recalculate the fingerprint from your stored record. If it matches, the record is unchanged. If it doesn't, something has been altered.

What to watch

Connected vehicle data is under increasing scrutiny. The UK's Information Commissioner's Office has warned motor manufacturers and insurers about the risks of processing driving data without clear consent ^[4], and the European Data Protection Board has published guidance on connected vehicles and GDPR ^[5].

In the EU, the GDPR fines can reach up to €20 million or 4% of global annual turnover, whichever is higher ^[3]. A company that cannot demonstrate lawful consent, or that fails to delete data after a valid withdrawal request, risks both regulatory action and the reputational damage that follows.

The GM settlement's 20-year monitoring period is a reminder that privacy failures have long tails. Independent audits, regular reporting and the ability to produce contemporaneous records are likely to be standard expectations, not optional extras.