General Motors settles California driver privacy case for $12.75M

General Motors has reached a privacy-related settlement with California law enforcement agencies, led by California attorney general Rob Bonta. Under the terms of the agreement, the automotive manufacturer will pay $12.75 million in civil penalties and alter its data-sharing operations. Specifically, the settlement mandates several key actions:

• Payment of $12.75 million in civil penalties.
• A five-year ban on selling driving data to consumer reporting agencies—which are defined as entities that collect and provide information about consumers.
• A 180-day deadline for General Motors to delete retained driver data, unless the company obtains explicit customer consent.

The settlement addresses allegations from Bonta’s office that General Motors sold the names, contact information, geolocation data, and driving behavior data of hundreds of thousands of Californians to data brokers, specifically Verisk Analytics and LexisNexis Risk Solutions. According to Bonta’s office, General Motors made roughly $20 million from these data sales, which were collected through the company’s OnStar program. However, Bonta’s office also reported that the data did not lead to increased insurance prices in California, likely because state insurance laws prohibit insurers from using driving data to set insurance rates.

The enforcement action highlights California’s strict stance on data minimization, which is the privacy principle of limiting data collection and retention. According to California attorney general Rob Bonta, the agreement “requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California’s privacy law — companies can’t just hold on to data and use it later for another purpose.” Bonta’s office alleged that General Motors engaged in illegal practices and sold the data of California drivers without their knowledge or consent, despite numerous statements reassuring drivers that it would not do so.

In response, General Motors stated that the settlement addresses Smart Driver, a product the company discontinued in 2024, and reinforces steps it has taken to strengthen its privacy practices. The company added that it is committed to being clear and transparent with customers about its practices and the choices and control they have over their information. Additionally, General Motors previously settled with the Federal Trade Commission, the US consumer protection regulator, over its data sales, which resulted in a ban on selling certain data to consumer reporting agencies.

Why it matters

This settlement highlights the aggressive enforcement of data minimization principles in California, forcing major automakers to rethink how they monetize connected vehicle data.