GM to Pay $12.75M in California Over OnStar Data Sales
GM agreed to a $12.75 million settlement over selling driver data to insurers in California.
Why it matters: The settlement is California’s largest under the CCPA and signals intensified scrutiny of corporate data handling. Legal teams at companies that collect consumer data face escalating privacy enforcement risks and must assess data-sharing compliance.
- GM sold names, contact info, location, and driving behavior data of Californians from 2020–2024.
- The data brought GM approximately $20 million in revenue nationwide through brokers Verisk and LexisNexis.
- California investigators found GM deceived drivers about OnStar data collection and usage.
- The settlement bans GM from selling driving data to consumer reporting agencies for five years and requires deletion of retained data unless consent is obtained.
General Motors will pay a $12.75 million penalty to resolve claims that it illegally sold detailed driving data of hundreds of thousands of Californians. The information—collected via GM’s OnStar service—included names, geolocation, and driving behavior, then bundled for sale to brokers such as Verisk Analytics and LexisNexis Risk Solutions from 2020 to 2024.
- The sales generated about $20 million in revenue nationwide for GM.
- California investigators found drivers had not consented, and GM's privacy policy said driving data would not be sold without approval.
- According to Attorney General Rob Bonta, "General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so."
Beyond the financial penalty, GM faces operational constraints: It must stop selling driving data to consumer reporting agencies for five years, delete any retained driving data within 180 days unless it secures consumer consent, and request brokers delete the information already shared.
The case spotlights the California Consumer Privacy Act’s teeth—marking the largest CCPA penalty to date—and sends a strong compliance message to data-heavy industries. GM discontinued its Smart Driver program that was central to the data collection in 2024.
- Brooke Jenkins, San Francisco DA: "Modern cars are rolling data collection machines. Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are."
The outcome places corporate legal teams on notice: consumer data and privacy policies must align in practice or risk steep regulatory action, especially under robust laws like the CCPA.
By the numbers:
- $12.75 million — GM’s civil penalty payment in settlement with California
- $20 million — Estimated GM revenue from driving data sales between 2020 and 2024
- 5 years — Prohibition period for GM on selling driving data to consumer reporting agencies