General Motors has agreed to pay $12.75 million in civil penalties to resolve allegations that it collected and sold the driving data of hundreds of thousands of California motorists without their knowledge or consent. The settlement, announced by California Attorney General Rob Bonta, marks one of the most significant state-level actions against an automaker over connected car data practices.
How the Data Was Collected and Sold
According to the California Attorney General’s office, GM collected personal information including names, contact details, geolocation data, and driving behavior through its OnStar connected vehicle program. The company then sold this data to two major data brokers — Verisk Analytics and LexisNexis Risk Solutions — which in turn made it available to insurance companies. The state alleges GM earned roughly $20 million from these data sales.
Also read: Fujifilm Instax Wide 400 review: Bigger prints, bigger fun, same analog charm
The practice came to light in 2024 when The New York Times reported that several automakers, including GM, were sharing driver behavior data with insurers, leading some customers to report unexpected increases in their insurance premiums. GM has since discontinued the Smart Driver product that was central to the data collection, a fact the company confirmed to Reuters in response to the settlement.
Why California Took Action
Bonta’s office emphasized that GM’s data sales violated California privacy law and consumer protection statutes, particularly because the company had made public assurances that it would not share driving data. The settlement requires GM to stop selling driving data to consumer reporting agencies for five years, delete all retained driver data within 180 days unless it obtains explicit consent, and request that LexisNexis and Verisk also delete the data.
Also read: Nvidia commits $40 billion to AI equity deals in 2026, with $30 billion going to OpenAI
Interestingly, the state noted that the data did not actually lead to higher insurance premiums for California drivers, likely because state insurance regulations prohibit insurers from using driving data to set rates. This distinction underscores the importance of state-level privacy protections, even when the intended commercial use of data is blocked by existing law.
Broader Implications for the Auto Industry
The settlement sends a clear signal to automakers that collecting and monetizing driver data without transparent consent carries significant legal and financial risk. This case follows a separate settlement between GM and the Federal Trade Commission, which issued a final order banning GM and OnStar from selling certain data to consumer reporting agencies. Together, these actions create a regulatory framework that may reshape how connected vehicle data is handled across the industry.
For consumers, the case highlights the importance of understanding what data their vehicles collect and how it may be used. While many drivers appreciate features like emergency response and navigation assistance, the line between helpful service and invasive surveillance remains a growing concern as vehicles become increasingly connected.
Conclusion
The $12.75 million settlement represents a meaningful enforcement action under California’s privacy laws, but it also raises questions about whether current penalties are sufficient to deter similar practices in the future. With automakers generating billions in revenue from connected services, consumer advocates argue that stronger federal privacy legislation may be needed to ensure consistent protections across all states. For now, California drivers can expect GM to comply with strict data handling requirements, while the broader auto industry watches closely.
FAQs
Q1: Did GM admit wrongdoing in the settlement?
GM did not admit liability as part of the settlement, but agreed to pay the penalty and comply with the data restrictions. The company stated the settlement addresses a product it discontinued in 2024 and reinforces steps it has taken to strengthen privacy practices.
Q2: Will affected California drivers receive compensation?
The settlement does not provide direct payments to individual drivers. The $12.75 million is paid as civil penalties to the state. However, affected consumers may have other legal options through private lawsuits.
Q3: What should I do if I own a GM vehicle and am concerned about data privacy?
GM has agreed to delete existing data within 180 days unless it obtains your consent. You can contact GM or OnStar customer support to inquire about your data and request deletion. It is also advisable to review your vehicle’s privacy settings and any connected services agreements you may have accepted.
