Key Takeaways
- • California regulators imposed a $12.75 million settlement on General Motors—the largest CCPA penalty in state history—for selling driving and geolocation data of hundreds of thousands of motorists to data brokers LexisNexis Risk Solutions and Verisk Analytics without consumer consent between 2020 and 2024.
- • GM collected sensitive data through its OnStar connected vehicle platform, including precise parking locations, speed, hard braking, and rapid acceleration, then repurposed it for undisclosed insurance-related driver-risk scoring despite privacy disclosures limiting use to requested services only.
- • The settlement marks California's first data minimization enforcement action and signals heightened regulatory scrutiny of connected vehicle data practices; GM must cease data sales to consumer reporting agencies and brokers for five years and delete retained driving data within 180 days absent affirmative consumer consent.
- • California regulators estimated GM generated approximately $20 million nationwide from these data sales and highlighted the compliance risk that Verisk contractually prohibited precise geolocation transfer—a warning sign GM's privacy operations allegedly failed to address.
- • The enforcement action underscores three core CCPA principles for institutional investors to monitor: accurate disclosures, meaningful consumer choice through notice and opt-out mechanisms, and purpose limitation requiring data retention and use only as reasonably necessary and proportionate to original collection purposes.
Summary
On May 8, 2026, California Attorney General Rob Bonta, alongside county district attorneys and the California Privacy Protection Agency (CalPrivacy), announced a $12.75 million settlement with General Motors to resolve allegations that GM sold driving data of hundreds of thousands of California motorists to data brokers without explicit consent. Regulators designated this as the largest California Consumer Privacy Act (CCPA) penalty in state history and California's first data minimization enforcement action, representing a significant escalation in connected vehicle privacy enforcement.
GM collected consumers' names, contact information, precise geolocation data (including parking locations), and driving behavior signals—such as speed, hard braking, and rapid acceleration—through its OnStar connected vehicle platform between 2020 and 2024. The company subsequently sold this information to LexisNexis Risk Solutions and Verisk Analytics despite privacy disclosures indicating data would only be used to provide requested services like emergency assistance, navigation, and driver support or shared at the consumer's express direction. Regulators alleged the data brokers intended to develop driver-risk scoring products marketed to auto insurers, with GM generating approximately $20 million nationwide from these arrangements. Although California law prohibits usage-based insurance practices, regulators noted that drivers in other states reportedly experienced premium increases tied to similar data-sharing practices.
The complaint alleges violations of California's Unfair Competition Law, False Advertising Law, and multiple CCPA provisions through misleading disclosures, unlawful secondary uses of personal information, and inadequate data governance. Regulators emphasized that GM violated the CCPA's purpose limitation and data minimization principles by collecting data for OnStar services but later repurposing it for undisclosed, unrelated insurance-scoring purposes. Notably, Verisk contractually prohibited precise geolocation data transfer—a compliance warning sign that GM's privacy personnel allegedly failed to appropriately address. The settlement further obligates GM to stop selling driving data to consumer reporting agencies for five years, direct data brokers to delete relevant information, and delete retained driving data within 180 days absent affirmative consumer consent. GM must also develop a comprehensive privacy compliance program and submit ongoing privacy assessments to California regulators.
Los Angeles District Attorney Nathan Hochman characterized the settlement as an indication that companies should expect higher penalties going forward. The enforcement environment is expected to intensify with California's August 1, 2026, rollout of the Delete Request and Opt-out Platform (DROP), which will require more than 500 registered data brokers to process centralized consumer deletion and opt-out requests. The settlement follows a similar FTC agreement with GM earlier in 2026 and reflects broader regulatory scrutiny of connected vehicle data practices, including recent California settlements involving Ford. A pending lawsuit filed by Texas against GM based on similar allegations remains outstanding.
GM collected consumers' names, contact information, precise geolocation data (including parking locations), and driving behavior signals—such as speed, hard braking, and rapid acceleration—through its OnStar connected vehicle platform between 2020 and 2024. The company subsequently sold this information to LexisNexis Risk Solutions and Verisk Analytics despite privacy disclosures indicating data would only be used to provide requested services like emergency assistance, navigation, and driver support or shared at the consumer's express direction. Regulators alleged the data brokers intended to develop driver-risk scoring products marketed to auto insurers, with GM generating approximately $20 million nationwide from these arrangements. Although California law prohibits usage-based insurance practices, regulators noted that drivers in other states reportedly experienced premium increases tied to similar data-sharing practices.
The complaint alleges violations of California's Unfair Competition Law, False Advertising Law, and multiple CCPA provisions through misleading disclosures, unlawful secondary uses of personal information, and inadequate data governance. Regulators emphasized that GM violated the CCPA's purpose limitation and data minimization principles by collecting data for OnStar services but later repurposing it for undisclosed, unrelated insurance-scoring purposes. Notably, Verisk contractually prohibited precise geolocation data transfer—a compliance warning sign that GM's privacy personnel allegedly failed to appropriately address. The settlement further obligates GM to stop selling driving data to consumer reporting agencies for five years, direct data brokers to delete relevant information, and delete retained driving data within 180 days absent affirmative consumer consent. GM must also develop a comprehensive privacy compliance program and submit ongoing privacy assessments to California regulators.
Los Angeles District Attorney Nathan Hochman characterized the settlement as an indication that companies should expect higher penalties going forward. The enforcement environment is expected to intensify with California's August 1, 2026, rollout of the Delete Request and Opt-out Platform (DROP), which will require more than 500 registered data brokers to process centralized consumer deletion and opt-out requests. The settlement follows a similar FTC agreement with GM earlier in 2026 and reflects broader regulatory scrutiny of connected vehicle data practices, including recent California settlements involving Ford. A pending lawsuit filed by Texas against GM based on similar allegations remains outstanding.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.