General Motors Pays $12.75 Million Record California Privacy Penalty

General Motors agreed to pay $12.75 million on Friday in civil penalties after California said general motors sold driving data from hundreds of thousands of motorists without their consent. The settlement imposes a five-year ban on selling data to consumer reporting agencies and forces the automaker to submit privacy assessments to the state.

Rob Bonta and California agencies

Hundreds of thousands of California motorists were swept into the case through data tied to names, location information, driving behavior, and contact information. Rob Bonta, the California attorney general, said, "This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians," after investigators said GM routed the data to LexisNexis Risk Solutions and Verisk Analytics.

$20 million in alleged revenue from 2020 to 2024 sharpened the stakes for state officials and helps explain why the case became the largest ever under the California Consumer Privacy Act. That 2018 law requires companies to tell consumers how their data is shared and to respect requests to stop the sharing, and California's case against GM was built by Bonta, several county district attorneys, and the California Privacy Protection Agency.

OnStar drivers and the one complaint

One Los Angeles resident helped set the case in motion after finding location data in a report requested about information collected on them, said Los Angeles District Attorney Nathan Hochman. He said, "This case shows more than anything that one consumer can make a huge difference," a line that captures how a single records request exposed a broader sales pipeline that officials say misled drivers who paid for OnStar emergency roadside and navigation service.

$2.7 billion in a separate California privacy settlement wave over the past 14 months, along with earlier deals involving Honda and Ford, shows how aggressively the state has moved against automakers that mishandled driving data. GM also faces the practical cost of five years without selling data to consumer reporting agencies, a restriction that cuts off a revenue path while state privacy reviews continue.

Five years of state oversight

$2.75 million and $5 million were part of the broader settlement pattern mentioned by California officials, but GM's $12.75 million penalty now sets the high-water mark under the privacy law. Bonta added, "I understand that there could be some overlap and maybe we’ll discover something in our investigation in surveillance pricing, but that wasn’t the focus of this case," separating this settlement from California's separate work on surveillance pricing.

For drivers, the immediate takeaway is blunt: California says GM can no longer keep selling driving data to consumer reporting agencies for five years, and the company must show the state how it handles privacy risk. For automakers, the case turns a data business into a regulatory liability, especially when personal location trails can be tied back to individual motorists.