General Motors (GM) sold location and driving data from hundreds of thousands of OnStar users to data brokers, California said. To settle the case, GM is writing a check for $12.75 million. The deal was announced by California Attorney General Rob Bonta on May 8.
The settlement still needs court approval, but it is already the largest penalty ever imposed under the CCPA, according to Bonta’s office.
It also prohibits GM from selling personal consumer data for five years. The company has 180 days to delete the retained driver data unless it obtains the customer’s consent to retain it.
GM sold user data to two brokers
California investigators found that GM Two brokers provided the data, Verisk Analytics and LexisNexis Risk Solutions, including participant names, phone numbers, home addresses, GPS location data, and records of how people drove.
People use GM OnStar to find their way, request emergency help, and get information while at the side of the road.
GM collected data from OnStar-enabled vehicles between 2016 and 2024. The company tracked where OnStar users drove, where they parked, how fast they drove, and when they pressed the gas.
GM reportedly earned about $20 million nationwide from these sales.
“General Motors sold California drivers’ data without their knowledge or consent, and despite numerous statements reassuring drivers that it would not do so,” Bonta said. “This collection of information included precise, personalized location data that can identify the daily habits and movements of Californians.”
Media reports in 2024, starting with The New York Times, revealed that automakers, including General Motors, were transferring driving behavior data to insurance companies.
Some drivers across the country said their insurance premiums went up after their data was shared.
Bonta’s office said California drivers did not see price increases tied to GM’s data sales. Under state insurance laws, insurance companies cannot use driving behavior data to determine rates.
Regulators are piling on GM
In January 2025, US Federal Trade Commission The FTC struck a deal with GM and OnStar that stipulates that for five years, the company cannot share or sell private data about where cars are parked and how drivers behave to consumer reporting agencies.
The Federal Trade Commission called GM’s conduct a “scandalous betrayal of consumer trust.”
The California case was a joint effort between several attorneys.
San Francisco District Attorney Brooke Jenkins, Los Angeles County District Attorney Nathan Hochman, Napa County District Attorney Allison Haley, and Sonoma County District Attorney Carla Rodriguez joined the action alongside Bonta’s office, with support from the California Privacy Policy Agency.
“Modern cars are data-gathering machines,” Jenkins said. “Californians should have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are.”
Tom Kemp, CEO of CalPrivacy, said the case shows that “companies should only collect what they need, use it responsibly, and be upfront with consumers about how their data is handled.”
GM He said Reuters The settlement addresses “Smart Driver, a product we discontinued in 2024, and reinforces the steps we have taken to strengthen our privacy practices.”
The company said it remains committed to being transparent with customers about its data practices and control over personal information.
Other than the fine, the settlement requires GM to stop selling driving data to any consumer reporting agencies. It must also request that Verisk and LexisNexis delete previously purchased data.
