General Motors will pay $12.75 million to settle claims that it collected and sold the personal data of hundreds of thousands of California drivers, without their knowledge, through its OnStar connected-vehicle system, California Attorney General Rob Bonta announced.
The settlement, which still requires court approval, ranks as a record privacy penalty under California law. It also bars GM from selling consumer driving data to any data brokers for five years and forces the automaker to submit regular privacy assessments to the state.
For four years, from 2020 to 2024, GM quietly harvested names, contact information, geolocation, and granular driving behavior through OnStar, then funneled that data to third-party brokers Verisk Analytics and LexisNexis Risk Solutions. State officials say GM pocketed roughly $20 million from those sales, meaning the penalty amounts to a fraction of what the company earned.
The data pipeline ran through OnStar, GM's long-running connected-services platform. Drivers who signed up, or whose vehicles came with OnStar features enabled, had their movements, habits, and personal details scooped up and packaged for sale.
Verisk Analytics and LexisNexis Risk Solutions, both major players in the insurance-data industry, were the buyers. The implications for ordinary drivers are obvious: precise location tracking and driving-behavior profiles landing in the hands of companies that feed risk-scoring models used by insurers.
Bonta's office did not mince words. In the attorney general's announcement, Bonta said:
"General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so."
That last clause matters. It isn't just that GM sold the data. It's that the company told drivers it wouldn't, and then did it anyway.
Bonta added that the data haul was far from abstract:
"This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians."
In other words, where you drive, when you drive, how fast you take corners, and how long you idle in a parking lot, all monetized without a word to the person behind the wheel.
GM representative Charlotte McCoy offered a measured statement to CalMatters, framing the settlement as old news tied to a defunct product:
"This agreement addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we've taken to strengthen our privacy practices."
Smart Driver was the specific feature at the center of the data collection. GM shut it down in 2024, the same year a New York Times investigation found that the automaker had gathered and sold data pertaining to millions of drivers nationwide, not just in California.
The timing is worth noting. GM did not voluntarily wind down Smart Driver before the scrutiny arrived. The program ran for four years. It ended after journalists and regulators started asking hard questions.
GM's broader approach to extracting revenue from vehicle owners has drawn criticism on multiple fronts. The automaker has touted massive profit margins from subscription fees charged to drivers for features that, in many cases, used to come standard.
The $12.75 million civil penalty goes to the state of California. No direct consumer payout to affected drivers is mentioned in the settlement terms described by the attorney general's office.
That means hundreds of thousands of Californians whose data was sold will not see a dime. The state collects; the drivers absorb the privacy violation.
AP News reported that GM earned approximately $20 million from the unlawful data sales between 2020 and 2024. A $12.75 million penalty against $20 million in revenue leaves the automaker with a net gain, not exactly a deterrent designed to change corporate behavior.
The settlement does impose structural requirements. GM must halt data sales to consumer reporting agencies for five years and submit privacy assessments to the state. Whether those assessments carry real teeth or amount to paperwork compliance remains to be seen.
Large corporate settlements in the tech and auto space have become a recurring pattern. Apple recently agreed to a $250 million settlement after selling iPhones on AI promises it couldn't deliver, raising similar questions about whether fines alone force meaningful change.
This isn't the only front where General Motors faces financial and legal consequences tied to corporate decisions. The automaker has also been navigating the fallout from trade-policy disputes, with GM expecting a $500 million tariff refund after the Supreme Court struck down certain levies.
Meanwhile, drivers continue to shoulder rising costs. GM has been betting big on subscription fees for in-car features, a strategy that treats the vehicle purchase as just the opening bid in an ongoing revenue extraction.
Taken together, the picture is one of a company that views its customers less as people who bought a product and more as a rolling data stream to be monetized at every turn, through subscriptions, through connected services, and, until regulators intervened, through the quiet sale of their most personal information.
Several gaps remain. The attorney general's announcement does not specify which GM vehicle models or model years were affected. It does not say whether GM admitted wrongdoing as part of the deal. And it does not detail any requirement that GM notify affected drivers individually.
The exact number of Californians whose data was sold is described only as "hundreds of thousands." The true scope could be far larger, particularly given the Times investigation's finding that millions of drivers nationwide were caught in the same data-collection net.
Which court must approve the settlement, and what specific statutes GM allegedly violated, also remain unaddressed in the public details released so far.
For the drivers who trusted that their car wasn't spying on them, those unanswered questions are cold comfort.
California's privacy enforcement apparatus caught GM red-handed. Credit where it's due. But the structure of the outcome tells a familiar story: the company profits, the state collects a check, and the people whose privacy was violated get nothing but a press release.
A $12.75 million fine against a corporation that pulled in $20 million from the same conduct is not accountability. It's a licensing fee, paid after the fact, at a discount.
When the penalty costs less than the crime paid, the lesson every boardroom learns is simple: do it again, and budget for the settlement.