General Motors has agreed to pay California $12.75 million to settle allegations that it sold detailed driving and location information on hundreds of thousands of state residents without their knowledge or consent. The penalty marks the largest imposed to date under the California Consumer Privacy Act.
The settlement, announced May 8 and still subject to court approval, comes after years of scrutiny over how automakers handle the vast streams of data generated by modern connected vehicles. GM collected the information through its OnStar subscription service. That service promises emergency assistance, navigation and other conveniences. But state officials say the company went further. It retained precise geolocation, speed, acceleration patterns and other behavioral details long after they served any immediate purpose. Then it sold them.
“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so,” California Attorney General Rob Bonta said in a statement. (Office of the California Attorney General)
The data went to two major brokers: LexisNexis Risk Solutions and Verisk Analytics. Buyers received names, phone numbers, home addresses, GPS coordinates of where vehicles drove and parked, plus records of speeding and hard acceleration. Sales ran from 2020 through 2024. GM reportedly earned about $20 million nationwide from the practice, according to the complaint.
But here’s the twist. California insurance rules bar the use of such data to set individual rates. So drivers in the state likely never saw their premiums rise because of it. The harm instead came in the quiet erosion of privacy. Location data can reveal visits to doctors’ offices, houses of worship, schools or political events. Combine it with speed and braking patterns and a portrait emerges of daily life that many would prefer to keep private.
San Francisco District Attorney Brooke Jenkins put it plainly. “Modern cars are rolling data collection machines. Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are.”
The case highlights a broader tension. Vehicle sensors and connectivity generate enormous value for manufacturers. They enable features customers want. They also create tempting new revenue streams from data sales. GM’s privacy policy once stated it did not sell driving or location data. It further claimed any disclosure for insurance purposes would require the consumer’s express direction. Investigators found those statements did not match the company’s actions.
This wasn’t GM’s first brush with regulators over these practices. The company previously settled with the Federal Trade Commission. That 2025 agreement barred GM and OnStar from selling sensitive vehicle geolocation and driver behavior data to consumer reporting agencies for five years. The FTC called the earlier conduct an “egregious betrayal of consumers’ trust.” (Reuters)
Yet the California action goes further in some respects. It emphasizes data minimization. Companies cannot simply hoard information and repurpose it later without fresh notice and consent. The settlement requires GM to delete retained driving data within 180 days unless customers affirmatively consent to continued storage. The company must also ask LexisNexis and Verisk to delete the data they received.
For five years, GM cannot sell driving data to any consumer reporting agencies, including data brokers. It must build and maintain a privacy program that assesses and documents risks tied to OnStar data collection. Regulators will receive regular reports on those assessments.
GM called the deal a reflection of changes already underway. “The settlement addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” the company told reporters. It added that it remains committed to transparency and giving customers control over their information. (TechCrunch)
Smart Driver, the now-defunct offering, encouraged OnStar subscribers to share driving data in exchange for feedback and potential rewards. Many customers signed up without fully grasping how that information might later leave the GM ecosystem.
The enforcement action drew support from district attorneys in Los Angeles, Napa, San Francisco and Sonoma counties, plus the California Privacy Protection Agency. Los Angeles County District Attorney Nathan J. Hochman warned other car companies. “To car companies who want to speed off with your data without your consent, these penalties should serve as a warning: No matter how big of a company you are, you will be held accountable in California.”
Napa County District Attorney Allison Haley focused on the sensitivity of location information. “If you know the precise location of a person’s car, then you know an enormous amount of personal, sensitive information about that person — their home, work, children’s school, place of worship.”
The case arrives as connected vehicles proliferate. New cars from nearly every maker now collect reams of telemetry. Some share it with insurers through optional programs that promise discounts for safe driving. Others feed it into broader analytics platforms. The GM matter shows regulators are paying attention to what happens after the initial collection.
California’s law demands purpose limitation. Gather data for roadside assistance. Fine. Hold it indefinitely to sell to brokers? Not without clear disclosure and consent. The settlement’s emphasis on deletion and restricted future sales signals that enforcers intend to make data minimization more than just words on paper.
Industry watchers expect more such actions. Other automakers have faced similar questions. A 2024 New York Times investigation first spotlighted how driving data reached insurance companies, sometimes without drivers realizing the downstream effects. While California’s insurance regulations muted the financial impact on drivers there, the privacy concerns remain universal.
GM’s $12.75 million payment stings. But for a company of its size, the real cost may lie in the precedent and the required overhaul of internal practices. The mandated privacy program and reporting obligations will force sustained attention from executives and engineers alike.
And the message travels beyond Detroit. Every manufacturer embedding sensors and connectivity must now weigh the convenience promised to customers against the regulatory and reputational risks of expansive data handling. Consumers, for their part, gain another example of why the fine print in subscription agreements matters.
The settlement does not require GM to admit wrongdoing. Still, its terms bind the company to concrete changes. No more secret sales to brokers. Faster deletion of unneeded data. Clearer accountability mechanisms. Whether those steps restore full trust remains to be seen. For now, California officials portray the outcome as a win for drivers who expect their cars to serve them, not commodify their movements.
Tom Kemp, executive director of the California Privacy Protection Agency, highlighted the collaborative effort. “This settlement reflects the power of coordinated enforcement,” he said. The agencies involved intend to keep that coordination going.
In the end, the GM case may mark a turning point. Automakers once treated vehicle data as largely their own to monetize. State regulators are asserting that those streams belong first to the people generating them. The $12.75 million check is simply the first visible toll on that road.
WebProNews is an iEntry Publication