General Motors has agreed to pay $12.75 million to settle allegations that it illegally collected and sold the driving and location data of hundreds of thousands of California motorists without their knowledge or consent, according to California authorities. The settlement, announced by California Attorney General Rob Bonta, comes amid growing scrutiny of how automakers gather and share consumer information through connected vehicle technologies.
Authorities alleged that between 2020 and 2024, GM sold sensitive driver data to data brokers including Verisk Analyticsand LexisNexis Risk Solutions. The information reportedly included names, phone numbers, addresses, geolocation records, travel patterns and driving behaviour such as speeding and sudden acceleration. Investigators said the data was collected through GM’s OnStar technology, which offers services including roadside assistance, navigation and emergency support.
California officials claimed the automaker continued selling the data despite repeatedly assuring customers that their personal information would not be shared in such a manner. Attorney General Bonta stated that the company sold Californians’ data “without their knowledge or consent”, adding that the information could reveal highly sensitive details about individuals’ daily routines and movements.
Under the proposed agreement, which still requires court approval, GM will face civil penalties amounting to $12.75 million and will also be prohibited from selling consumer driving data to data brokers for five years. The settlement further requires the company to tighten its data privacy practices and place restrictions on how it handles driver information in the future. Officials said the company would also be required to delete certain stored driving data within a specified period.
San Francisco District Attorney Brooke Jenkins said modern vehicles have effectively become “rolling data-collection machines” and stressed that consumers must clearly understand what information is being gathered and how it is being used. Authorities noted that precise vehicle location data can expose where people live, work, worship or seek medical treatment, raising major privacy concerns if the information is widely shared or sold.
The investigation into connected vehicle privacy practices began in 2023 and involved multiple California agencies, including the California Privacy Protection Agency and several district attorneys’ offices. The probe intensified after media reports in 2024 revealed that some automakers were sharing driving behaviour data with insurance companies, which allegedly used the information to influence insurance premiums in certain states.
Officials said GM earned nearly $20 million nationwide through the sale of consumer driving data. However, California authorities clarified that insurers in the state are barred by law from using such data to determine insurance rates, meaning California drivers were not directly affected through premium hikes.
In response to the settlement, GM stated that the agreement addresses concerns linked to its discontinued “Smart Driver” programme and said the company had already taken steps to strengthen privacy protections. The automaker added that connected vehicle services remain important for driver safety and convenience, while maintaining that it is committed to transparency regarding customer data practices.
