California driver – General Motors will pay $12.75M to resolve California privacy allegations involving OnStar-linked driving data sold to data brokers.
A privacy settlement carrying a seven-figure civil penalty is the latest sign that driver data is becoming a major regulatory battleground, with California alleging General Motors profited from customer information without clear consent.
GM has reached a privacy-related settlement with a group of law enforcement agencies led by California Attorney General Rob Bonta.. The dispute builds on earlier reporting that raised alarms about how automakers might share driving behavior with insurance-related data channels. potentially affecting how customers are priced.
The New York Times reported in 2024 that automakers, including GM, were sharing information about customers’ driving behavior with insurance companies.. Some drivers were reportedly worried that their insurance rates may have increased as a result. pushing the issue from abstract privacy concern into direct cost anxiety for consumers.
In its settlement announcement. Bonta’s office alleged that GM sold “the names. contact information. geolocation data. and driving behavior data of hundreds of thousands of Californians” to Verisk Analytics and LexisNexis Risk Solutions.. Both companies were described as data brokers. and the allegations suggest the scope of the data went beyond a simple contact record to include sensitive location and behavior details.
Bonta’s office said the data was collected through GM’s OnStar program.. It also alleged that GM made roughly $20 million from those data sales.. Separately. the office said the underlying information was treated as part of a commercial data pipeline rather than something customers could clearly opt out of at the time the data was collected and shared.
Still. the settlement announcement also included an important limiting point: Bonta’s office said the data did not lead to increased insurance prices in California.. The reasoning provided was tied to California’s insurance laws. which reportedly prohibit insurers from using driving data to set insurance rates.
Even without a direct pricing impact finding, regulators appear to be focusing on whether the data sharing process itself violated privacy expectations and state rules. As part of the settlement, GM agreed to pay $12.75 million in civil penalties.
The agreement also requires GM to stop selling driving data to any consumer reporting agencies for five years. That restriction targets a key downstream destination for data and suggests regulators want to interrupt future reuse of sensitive information tied to driving.
GM further agreed to delete any driver data it still retains within 180 days, unless it obtains consent from customers.. In addition, the company committed to requesting that Lexis and Verisk delete the data they received.. Together. those steps aim to reduce lingering exposure by addressing both the data GM holds and the data held by the broker recipients.
Bonta said the company sold the data of California drivers “without their knowledge or consent. ” even though GM had made statements reassuring drivers it would not do so.. He also linked the settlement to California’s broader privacy law theme of data minimization. warning that companies cannot simply keep data and repurpose it later for another use.
The settlement also sits in a wider enforcement timeline for GM. The company had previously settled with the Federal Trade Commission over its data sales, with a final order that banned GM and OnStar from selling certain data with consumer reporting agencies.
GM told Reuters that the settlement addresses Smart Driver. a product it discontinued in 2024. and that it reinforces steps GM said it has taken to strengthen privacy practices.. That clarification frames the settlement as connected to a specific product area. while still leaving the allegations focused on broader sharing and sale of driving-related records.
From a consumer privacy perspective. the case highlights how “driving behavior” can be treated as a monetizable dataset even when regulators dispute downstream harm.. California’s position that insurance pricing could not legally be set with driving data may limit one type of damage claim. but the settlement nonetheless targets collection. transfer. retention. and consent—areas regulators often view as independent violations.
For the industry. the agreement underscores why privacy compliance increasingly focuses on the lifecycle of data. not just the act of collection.. Limits on sales. mandatory deletion windows. and requirements to seek deletion from third parties can reshape data governance systems. including how connected-car telemetry is stored and what categories are allowed to flow to external entities.
For drivers. the outcome serves as a reminder that data from connected services like vehicle telematics programs can create obligations for companies even when products are later discontinued.. With the settlement in place. GM’s future handling of driving-related data in California is set to change. at least for the next several years. through restrictions aimed at stopping certain kinds of onward sharing.
General Motors privacy settlement OnStar driving data California AG settlement data brokers Lexis Verisk connected car privacy driver privacy rights