General Motors has agreed to pay $12.75 million in civil penalties to settle litigation filed by the state attorney general and several district attorneys that accused GM of illegally selling the personal driving data of hundreds of thousands of Californians.
Attorney General Rob Bonta and several county district attorneys, including Los Angeles DA Nathan Hochman, disclosed the GM settlement involving alleged California Consumer Privacy Act (CCPA) violations on May 8. The agreement is still subject to court approval.
The lawsuit, which was filed in Napa County Superior Court, followed an investigation showing that GM reportedly netted $20 million through sales of driving and location data collected through the company’s OnStar system, which can be used to call for help in the event of an accident or provide driving directions. GM did not acknowledge any liability as a result of the agreement.
The settlement also bars the automaker from selling driving data to any consumer reporting agencies for five years and requires GM to delete such data it currently possesses. In addition, GM must develop and operate a privacy program to monitor the risks of collecting data through the OnStar system.
A GM spokesperson said the program targeted by the probe has been phased out.
“This agreement addresses (OnStar) Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices,” the company spokesperson said in a statement emailed to the Southern California Record. “Vehicle connectivity is central to a modern and safe driving experience, which is why we’re committed to being clear and transparent with our customers about our practices and the choices and control they have over their information.”
The sales of driving and location data to two data brokers – Verisk Analytics Inc. and LexisNexis Risk Solutions – violated the CCPA and the state’s Unfair Competition Law, according to Attorney General Rob Bonta’s office.
“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so,” Bonta said in a prepared statement. “This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians.”
Hochman called GM’s previous practice patently illegal.
“To car companies who want to speed off with your data without your consent, these penalties should serve as a warning,” he said. “No matter how big of a company you are, you will be held accountable in California.”
The company sold the data without GM customers’ consent even though company policy mandated GM to inform customers about how their data would be used and any third parties that would gain access to it, according to Bonta’s office.
The settlement represented the office’s first action to enforce requirements added to the CCPA in 2023. It will divide up the settlement proceeds to offset investigative costs and provide additional privacy enforcement resources. The Los Angeles County Treasurer’s Office will receive $1.275 million, as will other counties involved in the investigation.
The parties will pay their own legal costs and attorney fees, according to the settlement.
The CCPA has been criticized by business groups for placing financial burdens on smaller enterprises and dampening the California economy.
