GM Settles California Privacy Case Over OnStar Data Sales for $12.75 Million

General Motors agreed to pay $12.75 million and accept new limits on its use of connected-car data after California officials said the automaker sold location and driving records from hundreds of thousands of OnStar subscribers without proper disclosure. The information, officials said, included names, phone numbers, home addresses, GPS location, speeds, rapid acceleration and hard braking, a trove that can reveal where drivers live, work and travel and could be used to track routines or reconstruct movements.

The settlement, announced May 8 and still subject to court approval, was led by California Attorney General Rob Bonta with the district attorneys of Los Angeles, San Francisco, Napa and Sonoma counties, and it had support from the California Privacy Protection Agency. California officials said GM collected and retained the data from 2016 through 2024, then began selling it in 2020 to LexisNexis Risk Solutions and Verisk Analytics without adequate disclosure or an opt-out option. Officials also said GM had told consumers it did not sell driving or location data and that the information would be used only for OnStar services.

California said GM earned about $20 million nationwide from the sales. Under the settlement, GM is barred for five years from selling driving data to consumer reporting agencies, including data brokers, and must face tighter restrictions on how it uses consumer driving data going forward. The case marks the state’s largest California Consumer Privacy Act penalty to date and its first enforcement action under the law’s data minimization principle.

Bonta said the case showed companies cannot keep data for one purpose and later repurpose it for another. Los Angeles County District Attorney Nathan J. Hochman said car companies cannot secretly profit from personal data, while San Francisco District Attorney Brooke Jenkins said automakers must clearly explain what data they collect, how they use it and what opt-out rights consumers have. The settlement underscores how fast connected-car technology has outpaced privacy protections, as vehicles have evolved into rolling data collection systems long before consumers were given meaningful control over what those systems record, sell or share.