California hits GM with record privacy fine over OnStar data

California said that General Motors (GM) sold location and driving data from hundreds of thousands of OnStar users to data brokers. To settle the case, GM is writing a check for $12.75 million. The deal was made public by California Attorney General Rob Bonta on May 8.

The settlement still needs court approval, but it’s already the largest penalty ever handed down under the California Consumer Privacy Act, according to Bonta’s office.

It also bars GM from selling personal consumer data for five years. The company has 180 days to delete retained driver data unless it gets customer consent to keep it.

General Motors sold user data to two brokers

California investigators found that GM gave two data brokers, Verisk Analytics and LexisNexis Risk Solutions, including subscriber names, phone numbers, home addresses, GPS location data, and records of how people drove.

People use GM’s OnStar to find their way, call for help in an emergency, and get information while they’re stuck on the side of the road.

GM collected the data from OnStar-supported cars between 2016 and 2024. The company tracked where OnStar users drove and parked, how fast they drove, and when they slammed on the gas.

GM reportedly pulled in around $20 million nationwide from these sales.

Media reports in 2024, starting with The New York Times, revealed that automakers, including GM, had been funneling driving behavior data to insurance companies.

Some drivers nationwide said their premiums went up after their data got shared.

Bonta’s office said California drivers didn’t see rate increases linked to GM’s data sales. Under state insurance laws, insurers can’t use driving behavior data to set rates.

Regulators pile on GM

In January 2025, the U.S. Federal Trade Commission (FTC) made a deal with GM and OnStar that for five years, the company could not share or sell private data about where vehicles are parked and how drivers behave to consumer reporting agencies.

The FTC called GM’s conduct “an egregious betrayal of consumers’ trust.”

The California case was a joint effort between several attorneys.

San Francisco District Attorney Brooke Jenkins, Los Angeles County District Attorney Nathan Hochman, Napa County District Attorney Allison Haley, and Sonoma County District Attorney Carla Rodriguez all joined the action alongside Bonta’s office, with support from the California Privacy Protection Agency.

CalPrivacy Executive Director Tom Kemp said the case shows that “companies must collect only what they need, use it responsibly, and be forthright with consumers about how their data is handled.”

GM told Reuters the settlement “addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.”

The company said it remains committed to transparency with customers about data practices and their control over personal information.

Beyond the fine, the settlement requires GM to stop selling driving data to any consumer reporting agencies. It also has to ask Verisk and LexisNexis to delete previously purchased data.

Still letting the bank keep the best part? Watch our free video on being your own bank.