California Says GM Made $20 Million Selling Driver Data Headed For The Insurance Industry

As modern vehicles collect more connected-car data than ever, regulators have started paying closer attention to how the industry handles that information. Last year, several owners, along with the states of Arkansas and Nebraska, sued General Motors over allegations it harvested driver telematics and sold the information to brokers. Now, GM has agreed to a $12.75 million settlement in California over those same practices.

The case was brought by the California Department of Justice and Attorney General Rob Bonta on behalf of state residents, who accused GM of funneling location and driving records from hundreds of thousands of drivers to two data brokers, Verisk Analytics and LexisNexis Risk Solutions, in direct violation of the California Consumer Privacy Act and the state’s Unfair Competition Law.

Read: Toyota Owner Didn’t Know His Car Was Talking To Insurers Until He Saw His Rates

This is not the first time GM has faced consequences over its OnStar data practices. In January 2025, the FTC barred the automaker from sharing customer location and driving information for five years, a federal action that preceded California’s separate case.

While laws in California prohibit insurers from using driving data to raise premiums for customers, the state’s lawsuit stated that selling personal and sensitive information, including an owner’s contact information, name, and geolocation data, was “patently illegal.” GM collected the data using the OnStar system fitted into its vehicles and made roughly $20 million nationwide selling it to Verisk Analytics and LexisNexis Risk Solutions, according to the California DOJ.

The investigation also found that GM gave consumers no notice their information was being passed to the two brokers. According to the California DOJ, “In its privacy policy, GM even stated that it did not sell any driving or location data and that if it did disclose any such data for insurance purposes, it would be at the consumer’s express direction.”

GM’s Punishment

In addition to paying $12.75 million in civil penalties, GM must stop selling driving data to consumer reporting agencies, including data brokers, for five years. The automaker must also delete any retained driver records within 180 days, request that Verisk and LexisNexis purge all GM-sourced information, and build a new privacy program “required to assess, mitigate, and document the risks of collecting data through OnStar.”

“Today’s settlement requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California’s privacy law – companies can’t just hold on to data and use it later for another purpose,” Attorney General Rob Bonta said. “I am proud to go to bat for the privacy rights of Californians and to collaborate with state and local partners who share the same commitment to consumer protection.”