CALIFORNIA — General Motors agreed to pay $12.5 million to settle claims that it illegally sold the location and driving data of hundreds of thousands of California drivers, according to state officials. The settlement is the largest California Consumer Privacy Act penalty in the state's history, according to California Attorney General Rob Bonta.

From 2020 to 2024, GM sold driver data, including names, contact information, location data, and driving behavior data, to Verisk Analytics Inc. and LexisNexis Risk Solutions, according to state investigators. The data came from drivers' use of OnStar, a GM-owned service that provides roadside assistance, navigation, and other services. Nationwide, the automaker earned approximately $20 million from selling data to the two firms.

"If we get word that a company is illegally collecting, storing or selling consumer data, we won't hesitate to look under the hood and hold them accountable to the law," Bonta said. District attorneys in Los Angeles and San Francisco participated in the investigation and settlement.

Under the settlement, which is pending court approval, GM will delete any driving data it has retained within 180 days and request that Verisk Analytics and LexisNexis Risk Solutions do the same. The company will also stop selling driving data to consumer reporting agencies for five years and develop a privacy program that assesses and mitigates the risks of OnStar data collection.

California law bars insurers from using driving data to set insurance rates. In 2024, GM shared consumer driving behavior data with insurance companies. The California Consumer Privacy Act gives consumers the right to request that businesses disclose the data they collect, opt out of the sharing or sale of their personal information, and request that businesses delete their data.

The California Privacy Protection Agency began investigating the privacy practices of connected cars in 2023. In 2025, the Federal Trade Commission barred GM and OnStar from disclosing location and driver behavior data to consumer reporting agencies for five years as part of a privacy action. Also in 2025, Honda was fined $632,500 for privacy violations, according to the agency.