GM Hit With Record $12.75M Fine for Selling Driver Data

General Motors just took the biggest hit in California’s privacy law history. The automaker agreed to pay $12.75 million to settle claims it secretly sold the driving data of hundreds of thousands of Californians to data brokers. State officials say the company tracked private locations, braking habits, and trip times while publicly promising drivers it would never share that information.

Inside GM’s Secret OnStar Data Sale

California Attorney General Rob Bonta announced the deal on May 8, 2026. He called it the largest civil penalty ever issued under the California Consumer Privacy Act.

The case targets data GM collected through OnStar’s Smart Driver program from 2020 to 2024. Investigators say the company quietly handed that information to two data brokers, Verisk Analytics and LexisNexis Risk Solutions.

Both brokers planned to package the data into driver-risk scores and sell them to auto insurance companies. GM earned roughly $20 million nationwide from these transactions.

The information was deeply personal. It included names, phone numbers, home addresses, GPS coordinates, hard braking events, rapid acceleration data, and exact records of where subscribers drove and parked.

“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so.” Attorney General Rob Bonta

Bonta’s office found GM’s own privacy policy directly contradicted what was happening behind the scenes. The company had publicly stated it did not sell driving or location data unless customers asked it to.

What the Settlement Forces GM to Do

The $12.75 million is only the start. The deal, pending court approval, comes with strict rules that reshape how GM handles driver data going forward.

Here is what the automaker must do now:

• Stop selling driving data to consumer reporting agencies for five years
• Delete any retained driving data within 180 days unless drivers give clear consent
• Formally ask LexisNexis and Verisk to destroy the data they bought
• Build a stronger privacy compliance program tied to OnStar
• Submit regular privacy assessments to state regulators and prosecutors

This is also the first time California has enforced its data minimization rule, a 2023 update that limits how long companies can hold personal data.

The fine dwarfs previous CCPA records. Until now, the biggest hit had been a $2.75 million deal with Disney back in February 2026.

The One Driver Who Cracked Open the Case

The backstory of this settlement is almost as striking as the fine itself. It started with a single California driver who pulled their own credit report.

Tucked inside that report was something they never expected to see. The document spelled out exactly when they drove, how far, and for how long.

That one find lit the fuse. It led to a private group chat, then a bombshell 2024 New York Times investigation, and finally a flood of federal, state, and local probes.

Los Angeles District Attorney Nathan Hochman said the case proves that one consumer can shake an entire industry. The FTC piled on in January 2026 with a similar order banning GM and OnStar from sharing the same data with consumer reporting agencies.

What Every Connected Car Owner Should Do

If you drive a modern car, this case is bigger than GM. San Francisco DA Brooke Jenkins put it plainly when she called today’s vehicles “rolling data collection machines.”

Californians get a powerful new shield starting August 1. More than 500 registered data brokers must honor delete requests submitted through the state’s Delete Request and Opt-out Platform, known as DROP.

GM, for its part, says this chapter is closing. The company shut down Smart Driver in 2024 and ended its data deals with both brokers that same year.

Spokesperson Charlotte McCoy said the agreement reinforces steps GM has already taken to strengthen its privacy practices. The company resolved the matter without admitting any wrongdoing.

Why the Whole Auto Industry Is Watching

The fallout is far from over. GM is still battling a federal class action covering roughly 16 million drivers nationwide, with parallel cases moving forward in Texas and Nebraska.

Hochman warned that the size of this fine, while small next to GM’s $2.7 billion in net income last year, is a clear signal that future penalties will climb. CalPrivacy Executive Director Tom Kemp said his agency is already pushing harder on the connected car industry.

Privacy experts have started calling driving data the “new oil” for insurers, lenders, and brokers. California drivers escaped premium hikes only because state law blocks insurers from using driving data to set rates.

Drivers in other states were not so lucky. The 2024 New York Times investigation found GM customers across the country whose insurance bills jumped by double digits after their data was sold without their knowledge.

For drivers everywhere, this case is a wake-up call. Every turn, every stop, and every late-night grocery run can be turned into a product without you ever knowing. The $12.75 million may sting GM’s wallet, but the louder message is the warning shot fired at every automaker selling a connected car today. Did you know your car was watching you this closely? Drop your thoughts in the comments below and share this story with friends and family who drive modern vehicles, because the next privacy battle is already happening in their driveways.