DETROIT — General Motors has agreed to pay $12.75 million to settle a privacy lawsuit brought by California regulators, who accused the automaker of illegally selling sensitive driver data collected through its OnStar vehicle telematics service without customer consent. The settlement, announced this week by California Attorney General Rob Bonta's office, requires GM to halt the sale of such data to consumer reporting agencies for the next five years and to delete retained information within 180 days unless it secures explicit permission from affected drivers.
The case stems from GM's now-discontinued Smart Driver program, which tracked driving behaviors like speed, braking and mileage through OnStar-connected vehicles. According to Bonta's office, the company sold this data to brokers such as Verisk and LexisNexis, who in turn shared it with insurance companies. This practice allegedly allowed insurers to adjust premiums based on the data, potentially raising costs for drivers who were unaware their information was being monetized.
“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so,” Bonta said in a statement. He added that the agreement “requires General Motors to abandon these illegal practices,” emphasizing the state's commitment to protecting consumer privacy under the California Consumer Privacy Act.
The issue first came to light in a 2024 investigative report by The New York Times, which detailed how GM and other automakers were sharing driver data with third parties, often without clear disclosure. The Times' reporting highlighted concerns from privacy advocates about the potential for such data to influence insurance rates and personal privacy, sparking regulatory scrutiny across the U.S.
This California settlement builds on earlier federal action against GM. In 2023, the Federal Trade Commission issued an order barring GM and its OnStar subsidiary from selling certain types of driver data to consumer reporting agencies. Bonta's office noted that while the FTC's intervention addressed national concerns, California's stricter insurance regulations likely prevented widespread premium hikes for residents, providing an additional layer of consumer protection.
GM, in a statement to Reuters, described the settlement as addressing the Smart Driver product, which the company discontinued in 2024 amid growing backlash. “This settlement addresses Smart Driver, a product we discontinued in 2024,” the spokesperson said, framing the resolution as closure on a defunct initiative rather than an admission of ongoing wrongdoing.
Under the terms of the deal, GM must not only cease data sales but also formally request that Verisk and LexisNexis purge any retained California driver information from their systems. The company is also required to implement new compliance measures to ensure future data handling aligns with privacy laws. These steps aim to restore trust with consumers who rely on OnStar for services like emergency assistance and vehicle diagnostics.
The controversy underscores broader tensions in the automotive industry as vehicles become increasingly connected. Modern cars generate vast amounts of data through sensors, GPS and infotainment systems, raising questions about ownership and usage rights. Privacy experts have long warned that without robust safeguards, this data could be exploited for surveillance or profit, echoing debates in tech sectors like social media and smart home devices.
California's aggressive stance on data privacy is not new; the state has led the nation with laws like the CCPA, which grants residents rights to know, delete and opt out of data sales. Bonta's office has pursued similar cases against other companies, including a $1.2 billion settlement with Google in 2022 over location tracking. In GM's case, the attorney general's investigation began after complaints from drivers and advocacy groups flagged discrepancies between the company's privacy policies and its actual practices.
While the settlement provides financial penalties and injunctive relief, it does not include direct compensation for affected consumers. However, California's insurance laws, which prohibit the use of certain telematics data for rate-setting without consent, may have mitigated immediate harms. Officials from Bonta's office expressed confidence that the agreement would deter similar conduct industry-wide.
GM, headquartered in Detroit, is one of the largest U.S. automakers, with a market capitalization of $71.05 billion as of recent trading. Its shares have performed strongly, gaining 65.89% over the past 12 months, with a 52-week high of $87.62 and a low of $46.82. Analysts at Benzinga have noted mid-term consolidation in the stock, alongside short- and long-term upward trends, suggesting investor resilience despite the legal setback.
The resolution comes at a time when GM is pivoting toward electric vehicles and advanced driver-assistance systems, which rely even more heavily on data collection. Company executives have previously touted OnStar as a key differentiator, offering features like remote start and crash response. Yet, the privacy flap has prompted calls for greater transparency, with some lawmakers in Congress pushing for federal standards to govern automotive data.
Consumer advocates welcomed the settlement but called for more. “This is a step forward, but drivers deserve compensation and ironclad assurances that their data won't be sold behind their backs again,” said one privacy group representative, speaking on condition of anonymity pending further review. Meanwhile, industry observers point out that competitors like Ford and Toyota face similar scrutiny, indicating the issue is systemic rather than isolated to GM.
Looking ahead, GM must navigate the five-year data sales ban while complying with deletion timelines. Failure to do so could invite further penalties, as California's regulators have shown willingness to enforce privacy rules aggressively. For drivers, the case serves as a reminder to review vehicle service agreements and opt out of data-sharing where possible.
As the automotive sector grapples with the ethics of connected cars, this settlement may set a precedent. It highlights the growing clash between innovation and privacy, with California once again at the forefront of holding corporations accountable. For now, GM can focus on its core business, but the episode underscores that in the data-driven age, trust is as valuable as any engine under the hood.