California hits GM with record privacy fine over OnStar data

California said that General Motors (GM) sold location and driving data from hundreds of thousands of OnStar users to data brokers. To settle the case, GM is writing a check for $12.75 million. The deal was made public by California Attorney General Rob Bonta on May 8.

The settlement still needs court approval, but it’s already the largest penalty ever handed down under the California Consumer Privacy Act, according to Bonta’s office.

It also bars GM from selling personal consumer data for five years. The company has 180 days to delete retained driver data unless it gets customer consent to keep it.

General Motors sold user data to two brokers

California investigators found that GM gave two data brokers, Verisk Analytics and LexisNexis Risk Solutions, including subscriber names, phone numbers, home addresses, GPS location data, and records of how people drove.

People use GM’s OnStar to find their way, call for help in an emergency, and get information while they’re stuck on the side of the road.

GM collected the data from OnStar-supported cars between 2016 and 2024. The company tracked where OnStar users drove and parked, how fast they drove, and when they slammed on the gas.

GM reportedly pulled in around $20 million nationwide from these sales.

“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so,” Bonta said. “This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians.”

Media reports in 2024, starting with The New York Times, revealed that automakers, including GM, had been funneling driving behavior data to insurance companies.

Some drivers nationwide said their premiums went up after their data got shared.

Bonta’s office said California drivers didn’t see rate increases linked to GM’s data sales. Under state insurance laws, insurers can’t use driving behavior data to set rates.

Regulators pile on GM

In January 2025, the U.S. Federal Trade Commission (FTC) made a deal with GM and OnStar that for five years, the company could not share or sell private data about where vehicles are parked and how drivers behave to consumer reporting agencies.

The FTC called GM’s conduct “an egregious betrayal of consumers’ trust.”

The California case was a joint effort between several attorneys.

San Francisco District Attorney Brooke Jenkins, Los Angeles County District Attorney Nathan Hochman, Napa County District Attorney Allison Haley, and Sonoma County District Attorney Carla Rodriguez all joined the action alongside Bonta’s office, with support from the California Privacy Protection Agency.

“Modern cars are rolling data collection machines,” Jenkins said. “Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are.”

CalPrivacy Executive Director Tom Kemp said the case shows that “companies must collect only what they need, use it responsibly, and be forthright with consumers about how their data is handled.”

GM told Reuters the settlement “addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.”

The company said it remains committed to transparency with customers about data practices and their control over personal information.

Beyond the fine, the settlement requires GM to stop selling driving data to any consumer reporting agencies. It also has to ask Verisk and LexisNexis to delete previously purchased data.

Still letting the bank keep the best part? Watch our free video on being your own bank.