GM agrees to pay $12.75 million in California driver privacy settlement

General Motors has reached a privacy settlement with a group of law enforcement agencies led by California Attorney General Rob Bonda.

Back to 2024, The New York Times was mentioned that automakers including GM were sharing information about their customers’ driving behavior with insurance companies and that some customers were concerned that their insurance rates had gone up as a result.

The announcement of the settlement by Bonta’s office similarly alleges that GM sold “the names, contact information, geolocation data and driving behavior data of hundreds of thousands of Californians” to Verisk Analytics and LexisNexis Risk Solutions, both data brokers. Bonta’s office further alleges that this data was collected through GM’s OnStar program and that the company made about $20 million in data sales.

However, Bonta’s office also said the data did not lead to increased insurance rates in California, “likely because under California insurance laws, insurers are prohibited from using driving data to set insurance rates.”

As part of the settlement, GM agreed to pay $12.75 million in civil penalties and stop selling driving data to consumer reporting agencies for five years, Bonta’s office said. GM also agreed to delete any driver data it still retains within 180 days (unless it receives customer consent) and to request that Lexis and Verisk delete that data.

“General Motors sold the data of California drivers without their knowledge or consent and despite numerous assurances to drivers that it would not do so,” Bonta said, adding that the settlement “requires General Motors to abandon these illegal practices and underscores the importance of data minimization in California’s privacy law.

GM previously settled with the Federal Trade Commission over its data sales, with a final order barring General Motors and OnStar from selling certain data to consumer reporting agencies.

GM he told Reuters that the settlement “addresses Smart Driver, a product we discontinued in 2024, and reinforces the steps we’ve taken to strengthen our privacy practices.”