by GM will pay $12.75 million for selling driver data in California
Modern vehicles are collecting more and more data about their owners, and regulators have begun to closely monitor how automakers handle this information. Last year, several owners, as well as the states of Arkansas and Nebraska, filed a lawsuit against General Motors, accusing the company of collecting driver telemetry and selling this data to brokers. Now GM has agreed to a $12.75 million settlement in California.
Essence of the allegations
The lawsuit was filed by the California Department of Justice and Attorney General Rob Bonta on behalf of state residents. They accused GM of transmitting location and driving data of hundreds of thousands of drivers to two major data brokers — Verisk Analytics and LexisNexis Risk Solutions. According to the plaintiffs, this is a direct violation of the California Consumer Privacy Act (CCPA) and the state’s unfair competition law.
This is not the first time GM has faced consequences for its OnStar data practices. In January 2025, the Federal Trade Commission (FTC) banned the automaker from sharing customers’ location and driving data for five years. This federal decision preceded California’s separate case.
Illegal sale of data
Although California laws prohibit insurers from using driving data to increase customers’ premiums, the state’s lawsuit noted that selling personal and sensitive information, including the owner’s contact details, name, and geolocation, was “blatantly illegal.” GM collected data using the OnStar system installed in its vehicles and earned approximately $20 million nationwide by selling it to Verisk Analytics and LexisNexis Risk Solutions, according to the California Department of Justice.
The investigation also revealed that GM did not inform consumers about the transfer of their information to the two brokers. According to the California DOJ:
“In its privacy policy, GM even stated that it does not sell any driving or location data, and that if it discloses such data for insurance purposes, it is only at the direct instruction of the consumer.”
Penalties for GM
In addition to paying $12.75 million in civil penalties, GM must stop selling driving data to consumer reporting agencies, including data brokers, for five years. The automaker is also required to delete all stored driver records within 180 days, demand that Verisk and LexisNexis destroy all information obtained from GM, and create a new privacy program “that must assess, mitigate, and document risks related to data collection through OnStar.”
“Today’s settlement requires General Motors to abandon these illegal practices and underscores the importance of data minimization in California’s privacy law — companies cannot simply store data and use it later for a different purpose,” said Attorney General Rob Bonta. “I am proud to protect the privacy rights of Californians and to work with state and local partners who share the same commitment to protecting consumer rights.”
This case is another signal for the entire automotive industry: collecting and monetizing driver data without their explicit consent can have serious legal consequences. Although GM has agreed to a settlement, this does not remove from the agenda the question of how automakers use information collected through connected systems. Given that similar lawsuits have already been filed in other states, and federal regulators, such as the FTC, are actively responding to such violations, increased scrutiny of data collection practices at all major automakers can be expected. For consumers, this means it is worth carefully reviewing the privacy policies of their vehicles and possibly limiting the amount of data they allow to be collected.
