General Motors agreed to pay $12.75 million in civil penalties for selling driving data of hundreds of thousands of California motorists to data brokers, allegedly without their consent.
The settlement, announced Friday, is the largest ever for violations of the California Consumer Privacy Act, a 2018 law that requires companies to tell consumers about how their data is shared and to respect requests to stop the sharing.
It stemmed from an investigation by California Attorney General Rob Bonta, several county district attorneys, and the California Privacy Protection Agency, which enforces the privacy act. They said General Motors misled drivers who paid for the emergency roadside and navigation service OnStar and made approximately $20 million from the unlawful sale of their data between 2020 and 2024. The information included names, location information, driving behavior, and contact information, Bonta said, which went to the data brokers LexisNexis Risk Solutions and Verisk Analytics.
鈥淭his trove of information included precise and personal location data that could identify the everyday habits and movements of Californians,鈥� Bonta said in a press release.
The settlement also requires GM to stop selling data to any consumer reporting agencies for five years and submit privacy assessments to the state, . It followed a earlier this year and California settlements with and over the past 14 months for their own violations of the privacy act.
California鈥檚 investigation of GM began after a found GM collected data about millions of drivers nationwide and sold it to insurance companies in order to charge the drivers higher premiums. Californians were not impacted by those premium hikes because a state law prohibits insurers from using driving data to set insurance rates, Bonta said.
Bonta told CalMatters at a press conference Friday that it鈥檚 unclear if location data collected by General Motors was used by other companies to make predictions about the prices people are willing to pay for goods. That practice is better known as and can leverage location data. Target from San Diego County鈥檚 district attorney over its alleged use of location for the technique. Bonta鈥檚 office began an investigation into the surveillance pricing practices of businesses in January.
鈥淚 understand that there could be some overlap and maybe we鈥檒l discover something in our investigation in surveillance pricing, but that wasn鈥檛 the focus of this case,鈥� he said.
Los Angeles District Attorney Nathan Hochman said the case started with one person finding location data in a report they requested about the data collected on them. That discovery, he added, led to investigations by journalists, prosecutors, and regulators.
鈥淭his case shows more than anything that one consumer can make a huge difference,鈥� he said.
Though the settlement isn鈥檛 much compared to the $2.7 billion in net income , Hochman called it an indication that companies should expect higher penalties in the future. California reached a privacy law violation settlement with Disney in February for $2.75 million, previously the largest of its kind.
In a statement shared with CalMatters, General Motors spokesperson Charlotte McCoy said, 鈥淭his agreement addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we鈥檝e taken to strengthen our privacy practices. Vehicle connectivity is central to a modern and safe driving experience, which is why we鈥檙e committed to being clear and transparent with our customers about our practices and the choices and control they have over their information.鈥�
Californians will soon have a new protection against companies that use their data without their consent. Starting August 1, the more than 500 data brokers registered with the state must comply with requests California residents can make using . The privacy protection agency introduced the tool earlier this year.
___
This story was originally published by and distributed through a partnership with The Associated Press.
Copyright © 2026 The Associated Press. All rights reserved. This material may not be published, broadcast, written or redistributed.
