General Motors has agreed to pay $12.5 million to resolve allegations that the automaker illegally sold location and driving data of hundreds of thousands of Californians, state officials said Friday.
The deal is an example of how automakers are facing increased scrutiny over accusations that they share driver data with the insurance industry, influencing how much people pay for coverage. California, however, has a law that prohibits insurers from using driving data to set rates.
“If we learn that a company is illegally collecting, storing or selling consumer data, we will not hesitate to look under the hood and hold them accountable under the law,” California Attorney General Rob Bonta said at a press conference.
The settlement is the largest penalty under the California Consumer Privacy Act in state history, Bonta said.
The law gives California consumers the right to request that companies disclose the data they collect. They can also choose not to share or sell their personal information and request that companies delete their data.
Investigators found that from 2020 to 2024, GM sold driver data, including names, contact information, location data, and driving behavior data, to data brokers Verisk Analytics, Inc. and LexisNexis Risk Solutions. The data comes from a driver's use of OnStar, which is owned by GM and provides roadside assistance, navigation and other services.
General Motors did not immediately respond to a request for comment. Several district attorneys across the state, including Los Angeles and San Francisco, were involved in the investigation and settlement.
Technology has played a larger role in the auto industry, but data collected from drivers can reveal personal information about people's daily habits, including where they leave their children and doctor visits.
The California Privacy Protection Agency began investigating the privacy practices of connected cars in 2023. While the state was investigating automakers, The New York Times reported in 2024 that GM was sharing consumers' driving behavior with insurance companies. Domestically, GM reportedly made approximately $20 million selling data to Verisk and LexisNexis.
The state privacy protection agency has already taken action against other automakers. Ford Motor Company was fined $375,703 in March and Honda was fined $632,500 in 2025 for privacy violations.
Under the deal with GM, which still needs court approval, the automaker would delete any driving data the company retained within 180 days and require the two data brokers to do the same. They would also stop selling driving data to consumer reporting agencies for five years and develop a privacy program that includes assessing and mitigating the risks of data collected by OnStar.
California's settlement with GM came after the Federal Trade Commission in 2025 also took action against the automaker and OnStar over their privacy practices, prohibiting them from disclosing location and driver behavior data to consumer reporting agencies for five years.
