GM Hit with Record $12.75 Million California Privacy Settlement Over Unauthorized Driver Data Sales

General Motors has agreed to pay $12.75 million to settle California charges that it violated millions of consumers' privacy by collecting and storing driving information without consent and selling it to data brokers—the largest fine ever issued under the California Consumer Privacy Act in its more than five-year history. The settlement, announced Friday by California officials, marks a significant enforcement milestone for the landmark privacy law and exposes how automakers have quietly monetized connected vehicle data.

The investigation revealed that GM collected and retained driving behavior data from millions of consumers without proper disclosure or consent, then sold that information to data brokers including Verisk and LexisNexis Risk Solutions. Under California law, companies can only collect data necessary for their services and must transparently inform consumers about how their information is used. The scale of the violations—spanning millions of drivers—signals systemic failures in GM's data governance and raises questions about industry-wide practices among connected car manufacturers.

Beyond the financial penalty, the settlement imposes substantial operational constraints on GM's data practices. The automaker must pause all sales of driving data to consumer reporting agencies and data brokers for five years and delete driving data after 180 days unless consumers provide affirmative consent. GM also agreed to request that Verisk and LexisNexis delete previously shared data. The case underscores growing regulatory scrutiny of automotive data collection and could signal broader enforcement actions against an industry that has increasingly turned connected vehicles into mobile data-harvesting platforms.