General Motors has agreed to pay $12.5 million dollars to settle claims that the automaker illegally sold location and driving data of hundreds of thousands of Californians, state officials said Friday.
The settlement is an example of how automakers are facing more scrutiny over allegations that they share driver data with the insurance industry, influencing how much people pay for coverage. California, though, has a law that bars insurers from using driving data to set rates.
“If we get word that a company is illegally collecting, storing or selling consumer data, we won’t hesitate to look under the hood and hold them accountable to the law,” California Atty. Gen. Rob Bonta said in a news conference.
The settlement is the largest California Consumer Privacy Act penalty in the state’s history, Bonta said.
The act gives California consumers the right to request that businesses disclose what data they collect. They can also opt out of the sharing or sale of their personal information and request that businesses delete their data.
Investigators found that from 2020 to 2024, GM sold driver data, including names, contact information, location data and driving behavior data, to data brokers Verisk Analytics Inc. and LexisNexis Risk Solutions. The data came from a driver’s use of OnStar, which is owned by GM and provides roadside assistance, navigation and other services.
GM said the agreement addresses a product called OnStar Smart Driver that the company discontinued in 2024. The product was meant to help improve people’s driving but faced privacy concerns from consumers. In 2024, GM also ended its partnership with the two data brokers and said it would enhance privacy controls.
“Vehicle connectivity is central to a modern and safe driving experience, which is why we’re committed to being clear and transparent with our customers about our practices and the choices and control they have over their information,” a GM spokesperson said in a statement.
Various district attorneys throughout the state, including in Los Angeles and San Francisco, were involved in the investigation and settlement.
Technology has been playing a bigger role in the auto industry, but the data collected from drivers can reveal personal information about people’s daily habits, including where they drop off their kids and doctor visits.
The California Privacy Protection Agency in 2023 started investigating the privacy practices of connected cars. As the state was looking into the automakers, the New York Times reported in 2024 that GM was sharing consumer driving behavior with insurance companies. Nationwide, GM reportedly made roughly $20 million from selling data to Verisk and LexisNexis.
The state’s privacy protection agency has taken action against other automakers before. Ford Motor Company was fined $375,703 in March and Honda was fined $632,500 in 2025 for privacy violations.
Under the GM settlement, which still needs court approval, the automaker would delete any driving data the company kept within 180 days and request that the two data brokers do the same. They would also stop selling driving data to consumer reporting agencies for five years and develop a privacy program that includes assessing and mitigating the risks of data collected from OnStar.
California’s settlement with GM came after the Federal Trade Commission in 2025 also took action against the automaker and OnStar for its privacy practices, barring them from disclosing location and driver behavior data to consumer reporting agencies for five years.
General Motors has agreed to pay $12.5 million dollars to settle claims that the automaker illegally sold location and driving data of hundreds of thousands of Californians, state officials said Friday.
The settlement is an example of how automakers are facing more scrutiny over allegations that they share driver data with the insurance industry, influencing how much people pay for coverage. California, though, has a law that bars insurers from using driving data to set rates.
“If we get word that a company is illegally collecting, storing or selling consumer data, we won’t hesitate to look under the hood and hold them accountable to the law,” California Atty. Gen. Rob Bonta said in a news conference.
The settlement is the largest California Consumer Privacy Act penalty in the state’s history, Bonta said.
The act gives California consumers the right to request that businesses disclose what data they collect. They can also opt out of the sharing or sale of their personal information and request that businesses delete their data.
Investigators found that from 2020 to 2024, GM sold driver data, including names, contact information, location data and driving behavior data, to data brokers Verisk Analytics Inc. and LexisNexis Risk Solutions. The data came from a driver’s use of OnStar, which is owned by GM and provides roadside assistance, navigation and other services.
GM said the agreement addresses a product called OnStar Smart Driver that the company discontinued in 2024. The product was meant to help improve people’s driving but faced privacy concerns from consumers. In 2024, GM also ended its partnership with the two data brokers and said it would enhance privacy controls.
“Vehicle connectivity is central to a modern and safe driving experience, which is why we’re committed to being clear and transparent with our customers about our practices and the choices and control they have over their information,” a GM spokesperson said in a statement.
Various district attorneys throughout the state, including in Los Angeles and San Francisco, were involved in the investigation and settlement.
Technology has been playing a bigger role in the auto industry, but the data collected from drivers can reveal personal information about people’s daily habits, including where they drop off their kids and doctor visits.
The California Privacy Protection Agency in 2023 started investigating the privacy practices of connected cars. As the state was looking into the automakers, the New York Times reported in 2024 that GM was sharing consumer driving behavior with insurance companies. Nationwide, GM reportedly made roughly $20 million from selling data to Verisk and LexisNexis.
The state’s privacy protection agency has taken action against other automakers before. Ford Motor Company was fined $375,703 in March and Honda was fined $632,500 in 2025 for privacy violations.
Under the GM settlement, which still needs court approval, the automaker would delete any driving data the company kept within 180 days and request that the two data brokers do the same. They would also stop selling driving data to consumer reporting agencies for five years and develop a privacy program that includes assessing and mitigating the risks of data collected from OnStar.
California’s settlement with GM came after the Federal Trade Commission in 2025 also took action against the automaker and OnStar for its privacy practices, barring them from disclosing location and driver behavior data to consumer reporting agencies for five years.
