Following its settlement with the FTC earlier this year over its sale of drivers' data to brokers, General Motors has now also reached a settlement in California. The company agreed to pay $12.75 million in civil penalties to settle the lawsuit led by Attorney General Rob Bonta on behalf of the people of California, and is banned from selling driving data to consumer reporting agencies for five years. The lawsuits came after a 2024 New York Times report revealed that GM collected consumers' driving data through its OnStar program and sold this information to data brokers Verisk Analytics and LexisNexis Risk Solutions, which in turn could market the data to auto insurers.
In some cases, that driving data could be used by insurers to increase customers' rates. However, in California, customers were likely spared this consequence, as laws in the state prohibit insurers from using driving data in this way. Nevertheless, the complaint alleges that GM violated consumers' privacy by nonconsensually selling data that included people's names, contact information, geolocation data and driving behavior data.
The settlement agreement stipulates that GM must delete any driving data it's retained within 180 days "except for certain limited internal uses," unless it has the customer's express consent. It also requires GM to develop a privacy program to assess the risks of collecting data through OnStar, and report its findings to the DOJ and other agencies. In a statement on Friday, Bonta said, "Today's settlement requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California's privacy law — companies can't just hold on to data and use it later for another purpose."
Facts Only
* General Motors agreed to pay $12.75 million in civil penalties to settle a California lawsuit.
* The lawsuit was led by Attorney General Rob Bonta.
* The settlement mandates that GM must delete driving data retained within 180 days, except for certain limited internal uses, unless explicit customer consent exists.
* GM is required to develop a privacy program to assess risks associated with collecting data through OnStar.
* GM must report the findings of its privacy program to the Department of Justice and other agencies.
* GM is banned from selling driving data to consumer reporting agencies for five years.
* The data involved names, contact information, geolocation data, and driving behavior data.
* The data was collected via GM's OnStar program.
* The lawsuit followed a 2024 New York Times report detailing the sale of driver data to Verisk Analytics and LexisNexis Risk Solutions.
* The complaint alleged the violation of consumer privacy through the nonconsensual selling of this data.
Executive Summary
Full Take
The narrative centers on the tension between corporate data monetization practices and established privacy protections, highlighting the systemic challenge of data ownership and minimization. The core issue is not merely a financial penalty but the violation of the principle that personal behavioral data, especially sensitive geolocation and driving patterns, should remain under consumer control. The fact that California laws prevented insurers from using this data for rate increases suggests a regulatory gap where specific state laws protected the immediate consumer consequence, yet the underlying act of nonconsensual collection and sale was deemed illegal. The settlement's requirement for data deletion and the establishment of a privacy program are structural responses designed to mitigate this power imbalance. This pattern suggests that regulatory frameworks must evolve beyond compensating for harm (like insurance rate hikes) to enforce data minimization and genuine consent at the point of collection. The broader implication is that unless data ownership is federally mandated and enforced, corporations retain the structural power to extract and monetize personal information, pushing responsibility onto the individual to navigate complex legal remedies rather than forcing systemic change in data handling protocols.
Patterns detected: ARC-0043 Motte-and-Bailey, ARC-0024 Ambiguity
Sentinel — Human
This article functions as a solid, fact-based summary of a corporate legal settlement, exhibiting the clear structure and contextual synthesis characteristic of human legal or investigative journalism.