GM has agreed to pay $12.75 million to California to settle claims that it collected and sold driver data without getting proper consent. This agreement follows an investigation into how the automaker handled sensitive information, including geolocation and driving behavior, which was reportedly shared with third-party data brokers.
According to TechCrunch reports, this settlement is the largest penalty ever given under the California Consumer Privacy Act (CCPA). For years, GM has been said to have collected this data through its OnStar service. This raised concerns that millions of drivers were being tracked without knowing it.
New Data Privacy Standards for GM Vehicles
California Attorney General Rob Bonta led an investigation that found GM sold the personal data of hundreds of thousands of Californians to data brokers like LexisNexis and Verisk Analytics between 2020 and 2024. The company reportedly generated about $20 million in sales nationwide. But the state said GM misled consumers by claiming in its privacy policy that it would not sell location or driving data.
According to The Guardian, the data included “precise and personal location data” that could identify drivers’ daily habits. While California law stops insurers from using this data to set rates, drivers in other states reportedly paid higher premiums because their data was sold. As a result of the settlement, GM must now follow several strict rules to protect consumer privacy. According to the State of California Department of Justice, the settlement includes the following protections for users:
- Five-Year Sales Ban: GM is prohibited from selling consumer driving data to any data brokers for a period of five years.
- Data Deletion: The company must delete any driving data it currently retains within 180 days, unless it receives the consumer’s express consent.
- Transparency Requirements: GM must request that the third-party brokers to which it previously sold data also delete that information.
- Privacy Oversight: The automaker must establish a robust privacy program to assess and mitigate risks associated with OnStar data collection.
CalMatters reports that this case highlights a growing trend of regulatory pressure on the automotive industry as vehicles become more connected. Attorney General Bonta called the settlement a “bellwether” for how interactive platforms should handle user information. He also indicated that California will keep enforcing strict data minimization rules.
In conclusion, the $12.75 million settlement marks an important step for driver privacy and holding companies accountable. By stopping unauthorized data sales and requiring more transparency, California is making it clear how GM and other carmakers should handle consumer information today.
