General Motors will pay $12.75 million to California to settle allegations that it violated the California Consumer Privacy Act by selling drivers' personal data without proper consent, California Attorney General Rob Bonta announced.
The settlement targets GM's practice of monetizing customer data collected through OnStar, the company's connected vehicle service. GM allegedly sold access to precise location information, speed, and other telemetry data to third parties without adequately disclosing these sales to drivers or obtaining explicit opt-in consent as required by CCPA.
The CCPA grants California residents the right to know what personal information companies collect, delete data upon request, and opt out of sales. GM's data sales practices conflicted with these baseline consumer protections. Drivers using OnStar services generated vast quantities of real-time location and behavioral data that represented valuable commercial inventory.
The settlement requires GM to implement enhanced transparency measures. The automaker must explicitly inform customers that their data will be sold and provide clear opt-out mechanisms before any third-party data sharing occurs. GM also faces restrictions on future data monetization without affirmative consumer consent.
This enforcement action reflects growing regulatory pressure on automotive manufacturers that treat connected vehicle data as a profit center. As vehicles become increasingly networked, regulators recognize that location history, driving patterns, and vehicle diagnostics represent sensitive personal information deserving legal protection.
The settlement applies to GM's practices in California but carries implications for the broader automotive industry. Other connected vehicle platforms collecting similar telemetry face comparable CCPA exposure. The case demonstrates that state privacy law enforcement extends beyond traditional tech companies to any business monetizing consumer data.
GM neither admitted nor denied wrongdoing as part of the settlement agreement. The company stated it would cooperate with the new requirements, though the $12.75 million penalty suggests the state found violations substantial enough to warrant significant financial consequences.