Cybersecurity Policy Report, GM to Pay $12.75M to Settle California Privacy Case, (May 8, 2026)
Organizations Mentioned:Verisk Analytics
General Motors Co. has agreed to pay $12.75 million in civil penalties to the state of California to settle the state’s claims that the automaker used California drivers’ data without consent in violation of the California Consumer Privacy Act (CCPA) and Unfair Competition Law, California Attorney General Rob Bonta (D.) announced today.
“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so,” AG Bonta said in a news release.
“This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians,” he said. “Today’s settlement requires General Motors to abandon these illegal practices and underscores the importance of data minimization in California’s privacy law—companies can’t just hold on to data and use it later for another purpose.”
The California Privacy Protection Agency (CalPrivacy) began looking at automakers’ privacy practices in 2023 amid reports that connected cars were collecting driving histories and other personal data and sharing it with data brokers (CPR, Aug. 1, 2023).
In GM’s case, the data was collected via OnStar Corp., a GM subsidiary, and sold to Verisk Analytics, Inc., and LexisNexis Risk Solutions, AG Bonta said.
“Between Lexis and Verisk, GM reportedly made approximately $20 million nationwide from these data sales. General Motors collected this data through consumers’ use of OnStar, which can provide directions or summon an ambulance in the case of a crash, among other functions. Both data brokers purchased this data intending to use it to develop a driver-rating product that could be marketed to auto insurers for use in setting rates,” he explained.
But GM failed to disclose the data sales to customers or seek their consent for its use, according to the complaint AG Bonta filed in California Superior Court.
“These practices violated the CCPA’s purpose limitation and data minimization requirements, added in 2023, that impose common sense limitations on when and how businesses use, retain, and share data with third parties. Today's settlement represents DOJ’s first action enforcing the data minimization principle,” AG Bonta said.
The settlement, which still requires court approval, includes the civil penalty and requires GM to stop selling driving data to consumer reporting agencies for five years and delete any driving data retained by the company, among other things.
Under the settlement, GM is not required to admit liability. “This agreement addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” a GM spokesperson said.
“Vehicle connectivity is central to a modern and safe driving experience, which is why we’re committed to being clear and transparent with our customers about our practices and the choices and control they have over their information,” the spokesperson added.
AG Bonta’s office coordinated the investigation with CalPrivacy and the district attorneys from the counties of San Francisco, Los Angeles, Napa, and Sonoma.
“This settlement reflects the power of coordinated enforcement, and CalPrivacy appreciates the close collaboration with the other enforcement agencies in bringing this case to a strong resolution,” said Tom Kemp, CalPrivacy’s executive director. “California’s privacy laws are clear: companies must collect only what they need, use it responsibly, and be forthright with consumers about how their data is handled.”
News: StateLegislation LitigationEnforcement DataPrivacy CCPA