Overview
- General Motors, which reached the deal Friday, will pay $12.75 million in a proposed settlement that state officials call the largest California Consumer Privacy Act penalty to date.
- Prosecutors say GM sold OnStar subscribers’ names, contact details, precise location data, and driving behavior from 2020 to 2024 to data brokers LexisNexis Risk Solutions and Verisk Analytics without sufficient disclosure or consent; OnStar is GM’s in‑car connectivity service.
- The agreement requires a five‑year halt on selling driving data to consumer reporting agencies, deletion of retained driving data within 180 days unless a driver gives express consent, purge requests to LexisNexis and Verisk, and a stronger privacy program with state reporting.
- Officials noted the case follows a 2025 Federal Trade Commission order restricting similar disclosures and said California’s insurance rules likely prevented higher premiums because insurers cannot use driving data to set rates.
- GM said the deal addresses its discontinued Smart Driver program and investigators estimate the company made about $20 million nationwide from data sales, a result that could spur broader changes as California and local prosecutors intensify connected‑car privacy enforcement.