Penalty Amount
$12,750,000
CalPrivacy and the California Attorney General secured a $12.75 million settlement from General Motors for data sharing practices from connected vehicles. The settlement includes injunctive terms to change business practices.
General Motors must pay a $12.75 million civil penalty and comply with injunctive terms to address data sharing practices from connected vehicles.
In-house legal teams should review vendor agreements with telematics providers, connected vehicle service providers, and data processors to ensure data sharing practices are clearly disclosed and authorized. Key clauses to examine include data processing agreements, consent mechanisms, opt-out procedures, and any provisions allowing sharing of vehicle data with third parties. Contracts should be updated to align with CCPA requirements, including explicit consumer consent for data sharing and robust opt-out mechanisms.
Entity
General Motors
Industry
AutomotiveOfficial Press Release
https://privacy.ca.gov/2026/08/state-collaboration-continues-growing-as-vermont-joins-consortium-of-privacy-regulators/
https://privacy.ca.gov/2026/05/when-it-comes-to-data-privacy-consumers-must-be-in-the-drivers-seat-attorney-general-bonta-partners-secure-12-75-million-general-motors-privacy-settlement/
California Privacy Protection Agency Enforcement Page
https://cppa.ca.gov/enforcement/
"General Motors"
"$12.75 million civil penalty"
"data sharing practices from connected vehicles"
$220.0M
General Motors agreed to a nationwide $220 million settlement over allegations that it sold drivers’ identifiable driving behavior and location data to data brokers, which then sold it to insurers. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
$220.0M
General Motors agreed to pay $220 million to resolve allegations that it sold identifiable driver behavior and location data to data brokers and insurers without adequately disclosing the practice or obtaining consumers’ consent. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
$7.1M
A bipartisan coalition of 36 attorneys general settled allegations that General Motors collected and sold drivers’ driving-behavior and location data to data brokers, whose customers included insurance companies. GM will pay $220 million nationally, with Minnesota receiving $7,095,664, and must obtain affirmative express consent before collecting or disclosing driving and location data.
$12.8M
California Attorney General Rob Bonta, along with multiple district attorneys and the California Privacy Protection Agency, announced a $12.75 million settlement with General Motors for illegally selling hundreds of thousands of Californians' location and driving data to data brokers Verisk and LexisNexis without notice or consent. The settlement includes the largest CCPA penalty to date, a five-year ban on selling driving data to consumer reporting agencies, and requirements to delete retained data and implement a robust privacy program.
Texas Attorney General Ken Paxton filed a lawsuit against General Motors for unlawfully collecting private driving data from over 1.5 million Texas drivers without consent and selling the data to third parties including insurance companies. GM allegedly deceived customers into enrolling in products like OnStar Smart Driver by falsely claiming enrollment was required to retain vehicle safety features, while concealing that enrollment authorized systematic collection and sale of detailed driving data. The action follows an investigation launched in June 2024 as part of the Texas AG’s data privacy initiative, and seeks to hold GM accountable for violating state privacy laws.
CalPrivacy (the California Privacy Protection Agency) issued Enforcement Advisory 2026-01 warning data brokers that providing incorrect information in their annual registration with California's data broker registry carries liability of a $200 fine per day. The advisory observes that the Enforcement Division has already brought multiple enforcement actions over reporting errors, and emphasizes that accurate registry disclosures are what make the newly launched Delete Request and Opt-Out Platform (DROP) work for Californians. No specific company was named and no penalty was imposed by the advisory itself; it functions as forward-looking guidance.