GM Agrees to $12.75 Million California Settlement Over Driver Data Collection
General Motors has agreed to pay $12.75 million to settle a California lawsuit accusing the automaker of improperly collecting and selling sensitive driver data gathered through its OnStar connected-vehicle system.
California Attorney General Rob Bonta announced the settlement on Friday, alleging GM and OnStar disclosed drivers’ names, contact information, geolocation information, and driving behavior data to third parties, including LexisNexis Risk Solutions and Verisk Analytics. State officials argued the companies failed to properly inform consumers that their information could be collected and sold for commercial purposes.
The proposed final judgment, filed in Napa County Superior Court, also imposes sweeping restrictions on GM’s future data practices. Under the agreement, the company must stop selling covered driving data to consumer reporting agencies for five years, delete retained driving data within 180 days unless consumers expressly authorize retention, and implement a long-term compliance program.
The settlement comes months after the Federal Trade Commission finalized a separate order restricting GM’s ability to share driver location and behavioral data without consumer consent. Both legal actions followed public scrutiny over the automaker’s OnStar data practices after a 2024 New York Times investigation reported that detailed vehicle information had been shared with data brokers tied to the insurance industry.
Court filings state GM earned roughly $20 million through the sale of OnStar-related data before the investigation and settlement. Information collected through OnStar allegedly included braking patterns, acceleration, speeding events, seat belt usage, nighttime driving activity, and trip duration.
California officials said drivers in the state were likely protected from insurance pricing consequences because state law generally prohibits insurers from using this type of driving behavior data to determine rates. State officials also argued that precise vehicle location information can reveal details about a person’s daily life, including where they live, work, worship, or seek medical care.
At the center of the case are California’s consumer privacy laws, including the California Consumer Privacy Act, or CCPA, and the state’s Unfair Competition Law. Under California privacy law, companies generally must explain what information they collect, how it may be used, and whether it may be shared or sold to outside parties.
According to the lawsuit, drivers cannot truly consent to the collection and sale of their information if disclosures are hidden in lengthy enrollment screens or buried in confusing privacy terms. The agreement places heavy emphasis on obtaining clearer permission from drivers before certain categories of information can be collected, disclosed, or sold.
The settlement also focuses on a privacy principle known as data minimization. Companies should collect only the information needed to provide a service instead of holding onto large amounts of location or driving information for unrelated commercial uses. California officials have increasingly pushed companies to reduce unnecessary retention of consumer information, arguing that stored data may later be exposed in breaches, shared with third parties, or used in ways consumers never expected.
Under the agreement, GM must change how it collects and shares certain driver information, including through clearer privacy notices during the OnStar enrollment process. The company also must obtain separate permission for different categories of collection and disclosure activities and allow California OnStar customers to disable certain location-based collection features in their vehicles remotely.
GM also agreed to conduct periodic reviews of its OnStar data practices and submit compliance reports to California authorities over the coming years.
