General Motors Settles California Lawsuit Over Secret OnStar Data Sales

General Motors agreed to pay $12.75 million in penalties to settle a California lawsuit alleging it collected and sold OnStar subscriber data without adequate disclosure or consent. The settlement, filed in Napa County Superior Court, bars GM from selling covered driving data to agencies for five years, requires deletion of retained data within 180 days (except with explicit consent), and mandates a privacy program overseen by the California Department of Justice and the California Privacy Protection Agency.

GM agrees California privacy settlement over sale of driver dataGM Agrees to $12.75 Million California Settlement Over Driver Data CollectionThe VergeEngadgetGM fined US$12.75m over driving data it promised not to sellGM Must Pay Millions For Selling Your DataGM Pays Record $12.75M California Privacy Penalty for Secret OnStar Data Sales

The case stems from a 2024 New York Times report that OnStar shared names, phone numbers, home addresses, GPS locations, speed, rapid acceleration, hard braking with data brokers LexisNexis Risk Solutions and Verisk Analytics. An FTC order in 2024 barred GM and OnStar from sharing similar data without consent. State officials estimate GM earned $20 million nationwide from the sales, while California law prohibits insurers from using such driving data to set rates.

GM agrees California privacy settlement over sale of driver data

Attorney General Rob Bonta said the settlement forces GM to abandon illegal practices and underscores California’s data-minimization rule. Los Angeles County District Attorney Nathan Hochman said the agreement makes clear that automakers cannot profit from undisclosed personal data. A GM spokesperson said the deal addresses the discontinued Smart Driver product and reaffirms the company’s commitment to privacy practices.

The Verge

GM’s lawyers argued that driving on public roads does not create a privacy claim, a position cited in a 2025 motion to dismiss a lawsuit. District attorneys and privacy advocates rejected this view, noting that location and behavior data can reveal intimate details of daily life and must be protected under law.

GM fined US$12.75m over driving data it promised not to sell

The settlement marks the first major enforcement of California’s 2023 data-minimization rule for the automotive sector, signaling heightened scrutiny of connected-vehicle data. It sets a precedent for how automakers must disclose, obtain consent for, and limit retention of telematics information, shaping industry practices nationwide.

GM Agrees to $12.75 Million California Settlement Over Driver Data Collection

• “General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so.” — Rob Bonta, California Attorney General

GM Must Pay Millions For Selling Your Data

• “This settlement makes clear that car companies cannot secretly speed off with your personal data for profit.” — Nathan Hochman, Los Angeles County District Attorney

GM agrees California privacy settlement over sale of driver data

• “Modern cars are rolling data-collection machines. Californians must have confidence that they know what data is being collected, how it is used, and what their opt-out rights are.” — Brooke Jenkins, San Francisco District Attorney

GM fined US$12.75m over driving data it promised not to sell

• “This agreement addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices.” — General Motors spokesperson

GM fined US$12.75m over driving data it promised not to sell

GM must file privacy assessments with state authorities, ensure LexisNexis and Verisk delete the data they received, and let California OnStar customers remotely disable location-based collection. The agreement is subject to court approval, and further enforcement may follow if compliance gaps arise.

GM agrees California privacy settlement over sale of driver data