The settlement, the largest CCPA penalty in California history, includes a 5-year ban on selling driver data to data brokers
Bloomberg / Getty Images
General Motors $GM has agreed to pay $12.75 million to settle a California investigation into allegations that the automaker illegally sold the driving and location data of hundreds of thousands of California residents to two data brokers, state Attorney General Rob Bonta announced late last week.
Pending court approval, the settlement is the largest penalty ever assessed under the California Consumer Privacy Act. At issue is data gathered from subscribers to GM's OnStar platform — a service offering features like turn-by-turn navigation and emergency dispatch — which was then sold to data brokers Verisk Analytics and LexisNexis Risk Solutions from 2020 through 2024. That data encompassed names, contact details, GPS coordinates, and records of how customers drove. Bonta's office estimates GM earned roughly $20 million from these transactions across the country.
The brokers' intent was to build products that scored drivers and marketed those scores to auto insurers for rate-setting purposes. However, investigators found no evidence that California policyholders saw their premiums rise as a consequence of the data sales — an outcome Bonta's office attributed to a state law that bars insurers from factoring driving behavior data into rate decisions.
Investigators found that GM gave consumers no notice of the data sales and misled them by implying the information would only be used to provide OnStar services. GM's privacy policy had stated that it did not sell driving or location data, and that any disclosure for insurance purposes would occur only at a customer's direction. GM also retained driving and location data beyond its operational use for OnStar — a practice California law prohibits — before selling it to the brokers.
"General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so," Bonta said in a statement.
Among the settlement's core requirements, GM is prohibited for the next five years from transferring driving data to consumer reporting agencies, a category that includes both Verisk and LexisNexis. Within 180 days, the automaker must purge any driving data still in its possession — absent explicit customer consent to keep it — and formally ask both brokers to destroy the information they previously acquired. GM is additionally required to develop and maintain a privacy program and report its privacy assessments to the California Department of Justice, participating district attorneys, and the California Privacy Protection Agency.
GM issued a statement saying the matter "addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we've taken to strengthen our privacy practices." The automaker also characterized itself as "committed to being clear and transparent with our customers about our practices and the choices and control they have over their information."
The settlement also marks the first California enforcement action under the CCPA's data minimization requirements, which were added to the law in 2023 and restrict how businesses use, retain, and share personal data. A prior federal action also targeted the same conduct: the Federal Trade Commission reached its own settlement with GM, resulting in an order that prohibits General Motors and OnStar from sharing specified categories of data with consumer reporting agencies, as TechCrunch reported.
The California investigation was conducted by Bonta's office in partnership with the district attorneys of Los Angeles, Napa, San Francisco, and Sonoma counties, with support from the California Privacy Protection Agency.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.
