The General Motors Settlement and What It Actually Means
General Motors agreed last year to a $220 million settlement over OnStar, its connected-vehicle service. The allegation was straightforward: GM collected location data from vehicles and sold access to that information to third parties without getting direct permission from vehicle owners first.
Not without some disclosure buried in a terms-of-service document. Without actual consent.
That distinction matters. And it matters more than the settlement number itself, because $220 million to a corporation the size of GM is a cost of doing business, not a punishment. The real question is what the settlement tells us about how American companies view the data they collect from customers.
What the OnStar Case Revealed
OnStar customers were told their location data would improve vehicle safety and service. That part was true. But GM also sold location information to data brokers, insurance companies, and other third parties. Vehicle owners were not told this was happening, and they could not opt out without disabling OnStar entirely—which meant losing the safety features they thought they had purchased.
This is the operating model for a significant portion of American corporate data collection. A service provides genuine value. That service collects data. The company then monetizes that data separately, in ways the customer neither authorized nor fully understands.
You agree to OnStar for roadside assistance and emergency services. You are not agreeing to become a revenue stream for a data-brokerage subsidiary you have never heard of.
The Consent Problem
The settlement required GM to change its practices going forward. OnStar customers can now opt out of location data collection without losing core vehicle services. That is progress. It is also an admission that the previous system was not legitimate consent.
Legitimate consent requires three things: transparency, specificity, and genuine choice. The customer needs to know what data is being collected. The customer needs to know exactly who will use it and how. And the customer needs to be able to refuse without losing access to the primary service.
The OnStar structure had none of those. The terms of service existed. But the terms of service are where consent goes to die. Nobody reads them. They are written to confuse. They are updated without notice. And they contain language so broad that a company can argue it covered any new monetization scheme that senior management dreams up.
Why This Matters Beyond One Automaker
GM did not invent this model. It refined it.
Your phone manufacturer collects location data. Your streaming service tracks viewing habits. Your fitness app knows when you leave home and when you return. Your insurance company is increasingly interested in how you drive and where you drive.
Each of these companies will tell you that you consented. You did—to the terms of service. You did not consent to what those terms actually enabled.
This is a conservative governance problem. The conservative case for free markets assumes that consumers can make informed decisions about which companies deserve their business. That assumption collapses when companies can collect behavioral data about you and sell it to parties you will never do business with, all within the legal framework of a document you never read.
Free markets work when prices and terms are transparent. Data collection has become systematically opaque.
The Regulatory Trap
The settlement is being treated as a regulatory victory. Federal regulators enforced the rules against a major corporation and extracted hundreds of millions of dollars.
But here is what actually happened: regulators waited years after the practice was running to sue about it. A court settlement changed the practice going forward. No criminal charges. No executive accountability. No admission of wrongdoing that would prevent the company from immediately moving the same practice to a different service or a different data stream.
And when the next company does the same thing with a different technology—because they will—we will do this again. Another settlement. Another press release. Another cost of doing business.
The problem is not that we lack rules about data collection. The problem is that the rules we have are enforced after the money is already made, not before.
What Should Actually Happen
If you believe in property rights—and if you call yourself a conservative, you should—then you have to believe that your personal data belongs to you, not to the corporation that happens to collect it.
That does not mean banning data collection. It means reversing the default. A company should not be allowed to sell your data unless you explicitly authorize that sale. Not "consent" as buried in a terms update. Authorization. In writing. Specific.
The automaker can still collect location data to improve your car's safety systems. But if they want to sell that data to an insurance company, they ask you. You say yes or no. If you say no, you keep your car and your service, and they do not get the revenue stream.
That is not anti-business. That is what actual consent looks like in a functioning market.
The OnStar settlement will change nothing about this industry-wide practice. It will make one company slightly more transparent and move the profit to another. The structure itself—companies collecting intimate behavioral data about millions of people and monetizing it without their knowledge—will remain.
That structure is not a feature of capitalism. It is a bug we have decided to accept because it is expensive to fix.
What You Should Do
Read the privacy policies of the services you use. Not the terms of service—those are designed to confuse. The privacy policy will tell you how a company uses your data.
If you do not like what you see, leave. Use a competitor. Tell your family why. That is the only signal that actually moves corporate behavior.
The regulators will catch up eventually, or they will not. Either way, the market works faster than the settlement pipeline.
