GM agrees to pay $12.75 million in California driver privacy settlement

General Motors has reached a privacy settlement with a group of law enforcement agencies led by California Attorney General Rob Bonta.

Back in 2024, the New York Times reported that automakers, including GM, were sharing information about their customers’ driving behavior with insurance companies, and some customers feared their premiums would rise as a result.

The settlement announcement from Bonta’s office similarly alleges that GM sold “the names, contact information, location data, and driving behavior data of hundreds of thousands of Californians” to data brokers Verisk Analytics and LexisNexis Risk Solutions. Bonta’s office further claims that this data was collected through GM’s OnStar program, and that the company earned approximately $20 million from selling the data.

However, Bonta’s office also said the data did not lead to insurance price increases in California, “perhaps because California insurance law prohibits insurance companies from using driving data to set premiums.”

As part of the settlement, GM agreed to pay $12.75 million in civil penalties and stop selling driving data to consumer reporting agencies for five years, Bonta’s office said. GM also agreed to delete any driver data it still has within 180 days (unless consent is obtained from customers) and to require Lexis and Verisk to delete that data.

“General Motors sold the data of California drivers without their knowledge or consent, despite numerous statements reassuring drivers that it would not do so,” Bonta said in a statement. The settlement “requires General Motors to abandon these illegal practices and emphasizes the importance of data minimization under California privacy law. Companies cannot just hold on to data and later repurpose it.”

GM previously settled with the Federal Trade Commission over data sales, which issued a final order barring General Motors and OnStar from selling certain data to consumer reporting agencies.

GM told Reuters the settlement “addresses smart drivers, a product we will discontinue in 2024, and reinforces the steps we have taken to strengthen our privacy practices.”