California has imposed a $12.75 million penalty on General Motors (GM) over allegations it sold location and driving data of hundreds of thousands of OnStar users to data brokers.

Cryptopolitan reported on May 10 that the settlement still requires court approval, but is the largest penalty under the California Consumer Privacy Act.

The settlement includes business restrictions as well as financial penalties. GM cannot sell consumer personal information for 5 years and must delete stored driver data within 180 days unless it obtains customer consent again. It must also stop selling driving data to consumer credit reporting agencies and request Verisk Analytics and LexisNexis Risk Solutions to delete previously purchased data.

California investigators concluded that GM provided to outside parties information collected from OnStar-equipped vehicles from 2016 to 2024. The data included subscribers' names, phone numbers, home addresses, GPS location information, driving and parking records, speed and whether there was rapid acceleration. OnStar is a service used for navigation, emergency calls and roadside assistance information.

California Attorney General Rob Bonta said GM sold data without customers' awareness or consent, despite repeatedly reassuring drivers it would not do so. He said the information at issue was precise and personal enough to identify the daily habits and travel routes of California residents.

Regulatory pressure on GM has already been building. The U.S. Federal Trade Commission in January 2025 reached a settlement with GM and OnStar barring them for 5 years from sharing or selling undisclosed data on vehicle parking locations and driver behavior with consumer credit reporting agencies. The FTC at the time described GM's conduct as a "serious betrayal" of consumer trust.

Data sales practices in the auto industry came to light in earnest through media reports in 2024. After it emerged that automakers had provided driving behavior data to insurers, some drivers claimed their premiums rose after data sharing. California authorities said driving behavior data cannot be used to calculate premiums under state insurance law, and that no cases were found among California drivers of premium increases linked to GM's data sales.

GM said the settlement covers matters related to its "Smart Driver" product, which it halted in 2024. The company said it was an opportunity to reaffirm steps it has taken to strengthen privacy practices, and it also stated it would provide customers transparency about how data is handled and their control over personal information.

The action has become a case of imposing tighter constraints on the scope of automakers' data use as vehicle software and connected services expand. The industry is drawing attention because sensitive vehicle data such as location information and driving habits is increasingly likely to face regulation not only on collection but also on sale, retention, deletion and consent procedures.