GM Pays Record $12.75M Penalty for California Privacy Violations
General Motors agreed to a record $12.75 million settlement with California for violating the Consumer Privacy Act by selling OnStar subscribers' driving and location data without consent. The investigation revealed GM earned approximately $20 million sharing sensitive information with data brokers like LexisNexis and Verisk Analytics between 2020 and 2024. Under the agreement, GM is banned from selling driver data to consumer reporting agencies for five years, must delete retained data within 180 days, and implement stricter privacy protocols. This landmark case underscores increasing regulatory scrutiny of automotive data practices.
Editorial summary awaiting refresh
Cross-source coverage
Wire timeline
General Motors Settles for $12.75 Million Over Illegal Driver Data Sales in California
General Motors has agreed to a historic $12.75 million settlement with the state of California to resolve allegations that it unlawfully sold drivers' location and behavioral data to third-party brokers. This penalty represents the largest enforcement action under the California Consumer Privacy Act to date. Prosecutors revealed that GM generated approximately $20 million nationwide from these sales, despite publicly reassuring customers that their data would remain private. The compromised information included precise location details that could reveal the daily habits and movements of California residents without their knowledge or consent. As part of the agreement, which is pending court approval, GM is prohibited from selling driving data to consumer reporting agencies for five years. The automaker must also delete retained driving data within 180 days unless users provide explicit consent for limited internal use. Furthermore, GM is required to instruct partners like LexisNexis Risk Solutions and Verisk Analytics to delete any received data. The company must establish a comprehensive privacy program for OnStar data and submit regular compliance reports to California authorities, signaling a strict stance on corporate data privacy violations.
Help Net SecurityGM Settles California Privacy Lawsuit for $12.75 Million Over OnStar Data Sales
General Motors has agreed to pay $12.75 million to settle a class-action lawsuit in California regarding privacy violations linked to its OnStar Smart Driver program. The settlement addresses allegations that GM collected sensitive driving data, including hard braking and speeding incidents, and sold it to data brokers like LexisNexis and Verisk, who then marketed it to auto insurers. This practice reportedly led to increased insurance premiums for some users. Although GM discontinued the Smart Driver program and terminated data-sharing agreements in 2024 following investigative reports by The New York Times, the company faces ongoing legal consequences. Under the settlement terms, GM must delete retained driving data within 180 days unless explicit customer consent is obtained. Additionally, California customers will gain the ability to disable remote data collection if they choose not to enroll in or withdraw from OnStar services. While GM did not admit liability, the Federal Trade Commission has also investigated the matter, proposing a five-year ban on sharing such data with consumer reporting agencies. Other states are still pursuing damages for similar privacy invasions, highlighting broader regulatory scrutiny of automotive data practices.
Yahoo FinanceGM Settles California Data Privacy Lawsuit for $12.75 Million
General Motors has agreed to pay $12.75 million to settle a data privacy lawsuit filed in California, which accused the automaker of selling driver location and behavioral data to insurance companies and data brokers. Under the terms of the proposed settlement, GM is prohibited from selling customer information to data brokers for a period of five years. Additionally, the company must provide California drivers with the option to prevent its OnStar service from collecting location data. The settlement requires GM to issue clear privacy notices during OnStar enrollment, delete all driver data covered by the lawsuit, and obtain explicit customer consent before collecting or using driving data in the future. This legal resolution follows a 2024 New York Times report revealing that automakers were sharing sensitive driving metrics, such as speed and braking habits, with third parties for pricing adjustments. It also aligns with a previous January 2026 settlement with the Federal Trade Commission regarding similar allegations. California Attorney General Rob Bonta emphasized that the settlement underscores the importance of data minimization principles under state privacy laws, ensuring companies cannot retain and repurpose consumer data without proper authorization.
The VergeGM Settles California Lawsuit Over Sale of Driver Data for $12.75 Million
General Motors (GM) has agreed to a $12.75 million settlement to resolve a California lawsuit alleging the unauthorized sale of OnStar subscribers' personal and driving data. The legal action, initiated by the California Attorney General and several district attorneys, claimed that between 2016 and 2024, GM collected sensitive information from hundreds of thousands of users, including names, addresses, GPS locations, and driving behaviors. While GM stated this data was solely for OnStar services like emergency response, authorities alleged the automaker sold it to third-party firms LexisNexis Risk Solutions and Verisk Analytics starting in 2020 without proper disclosure or consent. The settlement mandates GM to pay civil penalties, delete retained driving data within 180 days, and request data erasure from the involved third parties. Additionally, GM is prohibited from selling driving data to consumer reporting agencies for five years and must establish a comprehensive privacy program to ensure compliance with the California Consumer Privacy Act. This case underscores growing regulatory scrutiny over automotive data privacy and consumer rights in the digital age.
Yahoo FinanceGM Settles California Privacy Probe for $12.75 Million Over Data Sales
General Motors has agreed to pay $12.75 million in civil penalties to resolve an investigation by the California Attorney General regarding the illegal sale of consumer driving data. The probe revealed that GM sold detailed information, including names, addresses, and precise GPS locations, of hundreds of thousands of OnStar subscribers to data brokers between 2016 and 2024. This data, which tracked speeds and acceleration, was reportedly used by insurers elsewhere to justify rate hikes, although California law prohibits such practices. The settlement includes a five-year ban on selling personal data and restricts GM's use of consumer driving information. California Attorney General Rob Bonta condemned the actions as a betrayal of trust, noting that GM profited approximately $20 million nationwide from these sales despite assurances to customers that their data would remain private. The Federal Trade Commission had previously labeled GM's conduct an egregious violation of consumer trust. GM stated that the settlement addresses its discontinued Smart Driver product and reaffirms its commitment to strengthening privacy practices and transparency with customers regarding their personal information control.
Insurance JournalGM Settles California OnStar Data Privacy Probe for $12.75 Million
General Motors has agreed to pay a $12.75 million settlement to resolve an investigation by California authorities into privacy violations involving its OnStar driver data services. This agreement marks the largest penalty ever issued under the California Consumer Privacy Act (CCPA), highlighting a significant enforcement action against corporate data mishandling. As part of the settlement terms, GM is prohibited from selling driver data to third-party data brokers for a period of five years. The probe focused on how the automaker collected, used, and potentially shared sensitive location and driving behavior information from vehicles equipped with OnStar technology without adequate consumer consent or transparency. This case underscores the increasing regulatory scrutiny faced by technology-enabled automotive companies regarding user privacy rights. The substantial fine serves as a precedent for future CCPA enforcement, signaling that state regulators are willing to impose heavy financial penalties on corporations that fail to protect consumer data integrity. The settlement aims to enhance data protection standards within the automotive industry and ensure stricter compliance with state privacy laws.
QuartzGM Settles California OnStar Data Privacy Probe for $12.75 Million
General Motors has agreed to pay $12.75 million to settle an investigation by the California Attorney General regarding allegations that it illegally sold driving and location data of hundreds of thousands of residents. The probe found that GM sold data from its OnStar subscribers to data brokers Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024, despite privacy policies stating otherwise. This settlement marks the largest penalty under the California Consumer Privacy Act to date. Although the brokers intended to use the data for insurance risk scoring, investigators found no evidence that California drivers faced higher premiums due to state protections. GM failed to notify consumers and retained data beyond operational needs. As part of the agreement, GM is banned from transferring driving data to consumer reporting agencies for five years, must purge existing data within 180 days, and is required to establish a comprehensive privacy program with regular reporting to state authorities.
Yahoo FinanceGM Settles California Lawsuit for $12.75 Million Over Misuse of Driver Data
General Motors has agreed to pay $12.75 million in civil penalties to settle a lawsuit filed by California Attorney General Rob Bonta regarding the misuse of customers' driving data. This settlement follows an earlier agreement with the Federal Trade Commission over similar violations. The case stems from a 2024 report revealing that GM collected detailed driving information through its OnStar service and sold it to data brokers, including Verisk Analytics and LexisNexis Risk Solutions, without customer consent. Although California laws protect drivers from insurance rate hikes based on such data, the practice violated state privacy regulations by exposing names, contact details, geolocation, and driving behavior. Under the terms of the agreement, GM is banned from selling driving data to consumer reporting agencies for five years. Additionally, the company must delete retained driving data within 180 days, except for limited internal uses or where express consent is obtained. GM is also required to establish a comprehensive privacy program to assess data collection risks and report findings to relevant authorities, emphasizing the importance of data minimization and consumer privacy protection.
Engadget - Technology News & Expert ReviewsGM Settles for $12.75M Over Secret Sale of California Driver Data
General Motors has agreed to pay $12.75 million in civil penalties to settle allegations that it secretly sold the personal data of hundreds of thousands of California drivers. Led by California Attorney General Rob Bonta, law enforcement agencies accused GM of violating privacy laws by selling names, contact information, geolocation, and driving behavior data collected via its OnStar program to data brokers Verisk Analytics and LexisNexis Risk Solutions. The company reportedly earned approximately $20 million from these sales, despite previously assuring customers their data would not be shared. Although concerns were raised about potential insurance rate hikes, officials noted that California law prohibits insurers from using such data for pricing, preventing direct financial harm to drivers in this regard. As part of the settlement, GM must cease selling driving data to consumer reporting agencies for five years. Additionally, the automaker is required to delete retained driver data within 180 days unless explicit customer consent is obtained, and must request that the involved data brokers also delete the information. This case highlights strict enforcement of data minimization principles under California privacy laws.
SlashdotGeneral Motors Settles Data Privacy Lawsuit for $12.75 Million
General Motors has agreed to a $12.75 million settlement to resolve a two-year legal battle with California prosecutors regarding the alleged misuse of customer driving data. Led by Attorney General Rob Bonta, the investigation revealed that GM sold sensitive information, including names, contact details, geolocation, and driving behavior of hundreds of thousands of Californians, to data brokers such as Verisk Analytics and LexisNexis Risk Solutions. Although initial reports suggested this data influenced insurance rates, California law prohibits such practices, meaning drivers were not directly financially impacted. As part of the agreement, GM must cease selling driving data to consumer reporting agencies for five years, delete existing data within 180 days unless explicitly permitted by users, and establish a robust privacy program. Despite the penalty, GM reportedly earned approximately $20 million from these data sales, retaining a net profit. This settlement marks a significant victory for consumer privacy advocates, highlighting the growing scrutiny over how automotive manufacturers handle and monetize user data in the digital age.
MashableGM Pays Record $12.75 Million Penalty for California Privacy Violations
General Motors has agreed to pay a record $12.75 million in civil penalties for violating the California Consumer Privacy Act by selling the driving data of hundreds of thousands of motorists without consent. The settlement, announced by California Attorney General Rob Bonta, is the largest ever for such violations under the 2018 law. Investigations revealed that GM misled OnStar subscribers and generated approximately $20 million between 2020 and 2024 by sharing personal information, including location and driving behavior, with data brokers LexisNexis Risk Solutions and Verisk Analytics. As part of the agreement, GM is prohibited from selling data to consumer reporting agencies for five years and must submit regular privacy assessments to the state. This case follows a similar Federal Trade Commission settlement and highlights growing regulatory scrutiny over data practices in the automotive industry. Although the penalty is small compared to GM's annual net income, officials view it as a significant precedent for future enforcement. The investigation was initially triggered by a consumer discovering their location data in a report, underscoring the impact of individual vigilance. Additionally, new protections via the DROP platform will soon empower California residents to opt out of data sharing more effectively.
CalMatters