GM Fined $12.75M by California for Selling Drivers' Data Without Consent

General Motors has agreed to pay a $12.75 million civil penalty to the state of California to settle allegations that it sold drivers’ behavioral and location data without vehicle owners’ knowledge or consent. California is the first U.S. state to reach such a settlement with GM, which remains subject to court approval. Under the agreement, GM is prohibited for five years from selling driving data to any consumer reporting agency and must delete the relevant information it has already collected. The automaker is also required to ensure that two data brokers—LexisNexis Risk Solutions and Verisk Analytics—which previously purchased the data, delete all information they received. The investigation revealed that GM collected names, contact details, geolocation data, and driving behavior of hundreds of thousands of California residents through its OnStar system and sold this information to the two companies, generating approximately $20 million in revenue nationwide. California authorities were particularly concerned about whether this data was used to raise insurance premiums for local vehicle owners. GM stated that the Smart Driver program involved in the case was discontinued in 2024, and that this settlement further strengthens the company’s privacy protections. It emphasized its commitment to clearly informing customers about how their data is used and ensuring they understand their choices regarding data sharing. Additionally, in early 2025, the U.S. Federal Trade Commission (FTC) barred GM from selling sensitive driving data for five years and mandated that the company obtain explicit customer consent before collecting, using, or disclosing specific connected vehicle data.