GM Settles $12.75M California Lawsuit Over Sale of Drivers’ Data

General Motors (GM) has reached a settlement agreement with California Attorney General Rob Bonta, agreeing to pay $12.75 million following allegations of violating the California Consumer Privacy Act (CCPA).

The settlement stems from accusations that GM unlawfully collected and sold driving and location data of Californians to data brokers Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024.

An investigation into these actions commenced in 2024 after reports surfaced regarding automakers, including GM, sharing driver behavior data with insurers.

The data was reportedly obtained through GM’s OnStar subsidiary and its “Smart Driver” system, intended for use in driver-scoring products related to insurance.

The U.S. Federal Trade Commission (FTC) had previously criticized GM for this data collection, leading to a ban on selling drivers’ data for five years.

According to California authorities, GM failed to inform consumers or obtain their consent for the data collection, retaining the information longer than necessary and repurposing it for sale, generating $20 million nationwide.

Attorney General Rob Bonta expressed, “General Motors sold the data of California drivers without their knowledge or consent, including precise location data that could reveal personal habits and movements.”

The $12.75 million in civil penalties represents a record in California’s history and marks the first enforcement action focusing on data minimization rules.

Additionally, GM is mandated to:

• Stop selling driving data to consumer reporting agencies and brokers for five years.
• Delete retained driving data within 180 days unless consumers expressly consent to retention.
• Instruct LexisNexis and Verisk to erase previously received data.
• Implement a robust privacy compliance program and provide regular assessments to regulators.

California officials reassured drivers that the data sales by GM likely did not impact insurance premiums, as state law prohibits insurers from using driving data to determine rates.

Efforts to reach GM for comment on California’s announcement have been unsuccessful at the time of publication.

An artificial intelligence exploit combining four zero-days bypassed both renderer and OS sandboxes, hinting at a surge in new exploits. Join the Autonomous Validation Summit (May 12 & 14) to witness advanced validation techniques uncover vulnerabilities, validate controls, and complete remediation.

Claim Your Spot