California Fines GM $12.75M Over OnStar Data Sales

On May 8, California Attorney General Rob Bonta announced a $12.75 million settlement with General Motors after investigators found the automaker sold location and driving data from OnStar subscribers to data brokers. If a court approves the agreement, it would be the largest penalty imposed under the California Consumer Privacy Act and would bar GM from selling personal consumer data for five years.

State investigators concluded GM provided two data brokers, Verisk Analytics and LexisNexis Risk Solutions, with subscriber names, phone numbers, home addresses, GPS location records and driving-behavior information collected from 2016 through 2024. The records reportedly included where drivers parked and traveled, how fast they drove and instances of hard acceleration. California officials estimated GM earned about $20 million nationwide from the sales.

Under the settlement GM must stop selling driving data to consumer reporting agencies, ask Verisk and LexisNexis to delete previously purchased data, and remove retained driver information within 180 days unless customers give consent to keep it. The agreement still requires court approval.

The U.S. Federal Trade Commission issued a related order in January 2025 that bars GM and OnStar for five years from sharing private information about where vehicles are parked and how drivers behave with consumer reporting agencies. The FTC characterized the conduct as “an egregious betrayal of consumers’ trust.”

Bonta described the company’s actions as a sale of Californians’ data “without their knowledge or consent” and warned the information could identify “the everyday habits and movements of Californians.” San Francisco District Attorney Brooke Jenkins called modern cars “rolling data collection machines” and emphasized that drivers must know what data is collected and how to opt out. California Privacy Protection Agency executive director Tom Kemp noted companies must collect only what they need, use data responsibly, and be forthright with consumers about how their information is handled.

GM released a statement stating the settlement “addresses Smart Driver, a product we discontinued in 2024,” and added that the company has taken steps to strengthen its privacy practices and to give customers control over personal information.

OnStar provides navigation, emergency response and roadside assistance and relies on connected-vehicle data. Bonta’s office reported that California drivers did not experience rate increases tied to GM’s data sales because state insurance rules prohibit insurers from using driving-behavior data to set rates.

The case was filed by Bonta’s office with the participation of district attorneys from San Francisco, Los Angeles County, Napa County and Sonoma County, with support from the California Privacy Protection Agency. The settlement centers on disclosure and deletion requirements and a multi-year ban on certain sales of consumers’ location and driving information.