General Motors’ Driver Data Practices Trigger Record $12.75 Million Fine Under The California Consumer Privacy Act

On May 8, General Motors (GM) and its subsidiary OnStar LLC agreed to pay a record $12.75 million in civil penalties to resolve allegations that they violated the California Consumer Privacy Act (CCPA). According to California Attorney General Rob Bonta and local district attorneys, from 2020 to 2024 GM and OnStar collected and sold hundreds of thousands of drivers’ personal information, including geolocation and driving behavior data, to third-party data brokers without the drivers’ knowledge or consent. Regulators alleged that those brokers used the information to create driver rating products, which were then sold to insurance companies and, in some cases, used to increase premiums. Although California drivers did not face higher insurance premiums because state law bars insurers from using such data for rate increases, regulators argued that GM and OnStar still violated California privacy law by retaining the data longer than necessary and misleading consumers about its sales to data brokers.

In addition to the monetary penalty, GM and OnStar are prohibited for five years from selling drivers’ data to consumer reporting agencies. The settlement also requires the companies to delete driving data within 180 days unless they obtain customer consent to retain it, instruct data brokers to delete relevant data, implement a privacy program to assess and mitigate related risks, and submit those assessments to the California Department of Justice, the state’s privacy agency, and the district attorneys involved in the case. The agreement closely parallels a January settlement between GM, OnStar, and the Federal Trade Commission, under which the companies accepted a five-year ban on disclosing driver behavior and geolocation data to consumer reporting agencies without consumer consent.

At a press conference earlier this month, Bonta described the settlement as a significant example of CCPA enforcement and the state’s commitment to consumer protection. “We hope that the companies that collect consumer data take note,” he said. “If we get word that a company is illegally collecting, storing or selling consumer data, we won’t hesitate to look under the hood and hold them accountable to the law.”