California Attorney General Rob Bonta, joined by San Francisco County District Attorney Brooke Jenkins, Los Angeles County District Attorney Nathan J. Hochman, Napa County District Attorney Allison Haley, and Sonoma County District Attorney Carla Rodriguez, with support from the California Privacy Protection Agency (CalPrivacy), announced a settlement with General Motors (GM) regarding the unlawful sale of Californians' location and driving data. The settlement, subject to court approval, includes $12.75 million in civil penalties and strict injunctive terms, including a ban on selling consumer driving data to brokers.
In 2023, CalPrivacy launched investigations into the privacy practices of connected vehicles, engaging with GM and other automakers. By 2024, reports revealed that companies, including GM, were sharing driving behavior data with insurers, sometimes leading to higher premiums. The California Department of Justice (DOJ), in partnership with several county district attorneys and CalPrivacy's Enforcement Division, investigated whether Californians' insurance rates were affected.
The investigation found that between 2020 and 2024, GM sold names, contact details, geolocation, and driving behavior data of hundreds of thousands of Californians to Verisk Analytics and LexisNexis Risk Solutions. GM reportedly earned about $20 million nationwide from these sales. The data, collected via OnStar services, was used by brokers to develop driver-rating products for insurers. While California law prevented insurers from using such data to set rates, drivers in other states were impacted.
Investigators determined GM misled consumers by claiming in its privacy policy that it did not sell driving or location data, and that any disclosures for insurance purposes would require consumer consent. In reality, GM sold data without notice or consent, violating its own compliance program and California's Consumer Privacy Act (CCPA). GM also retained driving data longer than necessary, then sold it, breaching the CCPA's purpose limitation and data minimization requirements introduced in 2023. This settlement marks DOJ's first enforcement of the data minimization principle.
Under the terms of the settlement, GM is required to pay civil penalties of $12.75 million and halt the sale of driving data to consumer reporting agencies for five years. The company must also delete retained driving data within 180 days unless consumers provide express consent. In addition, GM is obligated to request Lexis and Verisk to erase any driving data they obtained. Finally, GM must implement a robust privacy program designed to assess risks, mitigate misuse, and ensure full compliance with the California Consumer Privacy Act (CCPA).
GM closed Friday's regular trading at $78.80 up $0.39 or 0.50%.
For comments and feedback contact: editorial@rttnews.com
Business News
May 08, 2026 15:50 ET Manufacturing and services sector survey results and labor market data from main economies were the highlight on the economics news front this week. Factory orders and jobs report dominated the news flow in the U.S. Similarly, industrial production data from German garnered attention in Europe. In Asia, purchasing managers’ survey results from China and the central bank decision from Australia were in focus.