General Motors’ Driver Data Practices Trigger Record $12.75 Million Fine Under The California Consumer Privacy Act

On May 8, General Motors (GM) and its subsidiary OnStar LLC agreed to pay a record $12.75 million in civil penalties to resolve allegations that they violated the California Consumer Privacy Act (CCPA). According to California Attorney General Rob Bonta and local district attorneys, from 2020 to 2024 GM and OnStar collected and sold hundreds of thousands of drivers’ personal information, including geolocation and driving behavior data, to third-party data brokers without the drivers’ knowledge or consent. Regulators alleged that those brokers used the information to create driver rating products, which were then sold to insurance companies and, in some cases, used to increase premiums. Although California drivers did not face higher insurance premiums because state law bars insurers from using such data for rate increases, regulators argued that GM and OnStar still violated California privacy law by retaining the data longer than necessary and misleading consumers about its sales