Loading story…
General Motors agreed to pay $12.75 million to settle California allegations that it collected, retained, and sold drivers’ geolocation, driving behavior, and other personal data without proper knowledge or consent, in violation of the California Consumer Privacy Act (CCPA). Prosecutors said GM used data gathered through its OnStar service and sold it to LexisNexis Risk Solutions and Verisk Analytics, which sought to use the information in driver-rating products for insurers; California said GM made about $20 million nationwide from the sales.
Under the proposed settlement, GM must stop selling driving data to consumer reporting agencies for five years, delete retained driving data within 180 days unless consumers provide affirmative express consent for limited internal uses, and ask LexisNexis and Verisk to delete data they previously received. The agreement, which still requires court approval, also requires GM to establish and maintain a privacy program tied to OnStar data collection and provide privacy assessments to California authorities; officials described the penalty as the largest CCPA fine to date.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Under the proposed agreement, GM must stop selling driving data to consumer reporting agencies for five years, delete retained driving data within 180 days unless consumers provide affirmative express consent for limited internal uses, and ask LexisNexis Risk Solutions and Verisk Analytics to delete data they received. GM must also establish a privacy program tied to OnStar data collection and report privacy assessments to California authorities.
California disclosed a proposed settlement requiring General Motors to pay $12.75 million over allegations that it collected, retained, and sold drivers’ geolocation, driving behavior, and related personal data without proper consent through its OnStar service. State officials said the matter produced the largest penalty in the history of the California Consumer Privacy Act, pending court approval.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **U.S. Federal Trade Commission (FTC)** finalized a **20-year consent order** with **General Motors (GM)** and its subsidiary **OnStar** after alleging the companies collected and sold **precise geolocation** and **driving behavior** data from millions of drivers without valid consent. The FTC said GM’s now-discontinued *Smart Driver* feature was presented as a driving-habits tool while enabling extensive telematics collection (including location and behavior signals such as braking and speed), with data flowing to third parties and ultimately being used by insurers in ways that could affect premiums or coverage decisions. Under the order, GM is **banned for five years** from sharing consumers’ geolocation and driving behavior data with **consumer reporting agencies**. For the full term of the order, GM must obtain **express consent** before collecting, using, or sharing connected-vehicle data (with limited exceptions such as emergency services), and must provide consumer controls including the ability to **opt out/disable precise geolocation collection**, request **copies** of their data, and seek **deletion**. Reporting also notes GM shut down *Smart Driver* in 2024 amid backlash and said it ended related third-party telematics arrangements tied to data brokers such as **LexisNexis** and **Verisk**.
Jun 29, 2026
Disney agreed to pay **$2.75 million** to settle allegations by the California Attorney General that it violated the **California Consumer Privacy Act (CCPA)** by making it difficult for consumers to opt out of the sale/sharing of their personal data. California alleged Disney’s opt-out mechanisms contained gaps that prevented users—including those logged into their accounts—from fully stopping data sharing across Disney’s services, devices, and platforms, and that data continued to be shared with **third-party ad-tech companies** whose code was embedded in Disney websites and apps. The settlement (pending court approval) requires Disney to implement a more comprehensive privacy program and provide California officials a **compliance update within 60 days** describing changes made to align with CCPA requirements. State officials characterized the penalty as the **largest fine to date under the CCPA**; Disney did not admit liability as part of the agreement and said it continues to invest in privacy protections across its streaming services.
Jun 29, 2026
A coalition of 42 U.S. state attorneys general reached an **$18 million settlement** with 23andMe over cybersecurity failures tied to the company’s 2023 breach, which exposed genetic and other personal information belonging to **6.9 million people**. Authorities said the company failed to defend against credential-based attacks, lacked adequate intrusion prevention, did not properly log and monitor for intrusions, failed to remediate known vulnerabilities, and did not investigate unusual login activity. The settlement also imposes new security and governance requirements on the **23andMe Research Institute**, which acquired the company’s assets, including genetic data, after its 2025 bankruptcy, while preserving customers’ rights to delete personal data and destroy genetic samples. In a related bankruptcy ruling, a U.S. judge held that **California cannot seek monetary damages** from the company formerly known as 23andMe because its Chapter 11 reorganization plan bars those claims, though the state may still pursue non-monetary remedies. The court said California had participated in the bankruptcy case and had an earlier opportunity to challenge jurisdiction, requiring the state to amend or dismiss its lawsuit to remove claims for civil fines. The bankruptcy process also created a customer claims fund, and the court has authorized **$46.75 million** in total payouts connected to the breach.
Aug 11, 2026