General Motors settles with California regarding driver data sales.
The company faces $12.75 million in civil penalties.
California leads as the first state to secure such a settlement.

General Motors has agreed to pay California $12.75 million in civil penalties after being found to have sold driver data. This marks the first state-level resolution with the Detroit automaker, which shared owners' locations and driving habits with third-party data brokers.

The agreement, pending court approval, bars GM from selling driving data to consumer reporting agencies for five years. The company must delete its records and direct LexisNexis Risk Solutions and Verisk Analytics - the brokers involved - to do likewise.

A GM spokesperson commented on the settlement:

This agreement addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we have taken to strengthen our privacy practices. Vehicle connectivity is central to a modern and safe driving experience, which is why we are committed to being clear and transparent with our customers about our practices and the choices and control they have over their information.

California launched its probe after a New York Times report exposed how GM and other carmakers shared driving data with insurers, potentially hiking premiums. Officials sought to check if such data influenced California rates.

The California Privacy Protection Agency found that GM sold names, contact details, geolocation, and driving behavior data for hundreds of thousands of residents. Nationwide, the firm earned about $20 million from sales to LexisNexis and Verisk via its OnStar service.

Although GM sold data on Californians, state laws prevented insurers from using it for rate-setting, sparing drivers any impact. Attorney General Rob Bonta stated:

General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so. This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians.

Further Probes into GM Data Practices

Following the 2024 New York Times article, multiple states initiated reviews of General Motors. Texas quickly filed a lawsuit over unauthorized data sales.

Texas AG Ken Paxton labeled the data collection invasive and disturbing. Nebraska, Indiana, and Arkansas have also launched inquiries into GM's privacy handling.

In early 2025, the Federal Trade Commission prohibited GM from selling sensitive driving data for five years. The federal deal mandates affirmative customer consent for collecting, using, or sharing specific connected vehicle data.

Our Perspective: The penalty seems modest for GM, especially since data sales brought in limited revenue. Automakers repeatedly claim they are not raking in huge profits from this practice, leaving us to question why they pursue it amid widespread customer unease.