General Motors Settles California Case Over Sale of Driver Location Data

General Motors agreed to pay $12.75 million to settle California allegations that it collected, retained, and sold drivers’ geolocation, driving behavior, and other personal data without proper knowledge or consent, in violation of the California Consumer Privacy Act (CCPA). Prosecutors said GM used data gathered through its OnStar service and sold it to LexisNexis Risk Solutions and Verisk Analytics, which sought to use the information in driver-rating products for insurers; California said GM made about $20 million nationwide from the sales.

Under the proposed settlement, GM must stop selling driving data to consumer reporting agencies for five years, delete retained driving data within 180 days unless consumers provide affirmative express consent for limited internal uses, and ask LexisNexis and Verisk to delete data they previously received. The agreement, which still requires court approval, also requires GM to establish and maintain a privacy program tied to OnStar data collection and provide privacy assessments to California authorities; officials described the penalty as the largest CCPA fine to date.