General Motors to pay $12.75 million, about €11.8 million, over sale of driver data
General Motors reached a settlement with California authorities that will see the car maker pay $12.75 million, about €11.8 million, in civil penalties over the alleged unlawful sale of driver and location data. The case centres on data collected through OnStar and marks the largest financial penalty yet under California’s Consumer Privacy Act, better known as CCPA.
GM sold data to two brokers
According to the California attorney general, General Motors sold the names, contact details, location data and driving behaviour information of hundreds of thousands of California drivers between 2020 and 2024. The buyers were two data brokers, LexisNexis Risk Solutions and Verisk Analytics. The information came through OnStar, GM’s connected car service.
Authorities said the brokers used the data to develop products that could be offered to insurance companies for assessing driver risk. California’s official statement stressed, however, that drivers in the state were not directly hit by higher insurance premiums, because California law bars the use of such driving data when setting insurance rates.
The settlement brings new restrictions
The settlement still needs court approval. Under its terms, GM must pay $12.75 million, about €11.8 million, in civil penalties, stop selling driving data to consumer reporting companies for five years and delete stored driving data within 180 days unless the customer gives clear consent for its use.
GM must also ask LexisNexis and Verisk to delete the data they received, and create a stronger privacy programme to assess the risks and legal compliance of information collected through OnStar under California law.
Federal action came first
GM’s data practices had already drawn scrutiny in the United States. In January 2026, the Federal Trade Commission approved an order banning GM and OnStar for five years from sharing consumers’ location and driving behaviour data with consumer reporting companies. According to the FTC’s earlier complaint, GM did not explain clearly enough to customers that the Smart Driver feature collected precise location and driving behaviour data and sold it to third parties.
The California case differs from the federal action mainly because of the money. The FTC settlement largely imposed a ban and the threat of penalties for future breaches. California’s deal gives GM a direct financial bill.
Connected cars bring connected risks
California authorities estimated that GM made roughly $20 million, about €18.5 million, nationwide from selling the data. That puts the $12.75 million, about €11.8 million, settlement in a broader context. A connected car is no longer just a vehicle. It is also a digital platform that keeps watching, recording and reporting.
For car makers, the question becomes harder to dodge. When a vehicle collects location, speed, braking and driving habits, customers need to know why that data exists, who receives it and how they can refuse. GM’s case shows that data can bring extra revenue, but without consent and transparency it can quickly turn into a legal problem and a reputational bruise.
