California Fines GM $12.75 Million for Illegally Selling Driver Data to Insurers

General Motors (GM) has agreed to a $12.75 million settlement with California over allegations that it illegally sold sensitive driving data to two major data brokers, Verisk Analytics and LexisNexis Risk Solutions, without proper consumer consent.

The settlement resolves a lawsuit filed by the California Department of Justice and Attorney General Rob Bonta, who accused GM of violating the California Consumer Privacy Act and the state’s Unfair Competition Law.

How GM Collected and Sold Driver Data

According to the lawsuit, GM harvested location and driving records from hundreds of thousands of drivers using its OnStar telematics system. The company then sold this personal and sensitive information—including names, contact details, and geolocation data—to the two data brokers, generating approximately $20 million nationwide.

The investigation revealed that GM provided no notice to consumers that their data was being shared. In its privacy policy, GM had claimed it did not sell driving or location data unless explicitly directed by the consumer—a statement contradicted by the lawsuit.

Previous Regulatory Actions Against GM

This is not the first time GM has faced consequences for its data practices. In January 2025, the Federal Trade Commission (FTC) barred the automaker from sharing customer location and driving information for five years, a federal action that preceded California’s separate case.

While California law prohibits insurers from using driving data to raise premiums, the state’s lawsuit emphasized that selling personal information without consent was “patently illegal.”

Terms of the California Settlement

• GM must pay $12.75 million in civil penalties.
• The automaker is banned from selling driving data to consumer reporting agencies, including data brokers, for five years.
• GM must delete any retained driver records within 180 days.
• The company must request that Verisk Analytics and LexisNexis Risk Solutions purge all GM-sourced information.
• GM must establish a new privacy program to assess, mitigate, and document risks associated with OnStar data collection.

“Today’s settlement requires General Motors to abandon these illegal practices and underscores the importance of data minimization in California’s privacy law—companies can’t just hold on to data and use it later for another purpose.”

— Attorney General Rob Bonta

Bonta added that the settlement reinforces California’s commitment to protecting consumer privacy rights.