May 8, 2026: General Motors to Pay $12.75M to Settle California Consumer Protection Lawsuit Alleging Data Privacy Violations

The company allegedly sold California OnStar subscribers' personal information to data brokers without proper disclosure or consent

LOS ANGELES - General Motors, LLC will pay $12.75 million to resolve a civil lawsuit alleging that from 2020-2024, General Motors unlawfully sold hundreds of thousands of OnStar subscribers' personal information and driving data to third party data brokers in violation of California's privacy, false advertising and unfair competition laws.

"This settlement makes clear that car companies cannot secretly speed off with your personal data for profit," Los Angeles County District Attorney Nathan J. Hochman said. "Consumers have a fundamental privacy right to control their personal information, and this right does not stop at a car door. We appreciate the California Attorney General, the California Privacy Protection Agency and our partner District Attorneys for holding companies who do business in California accountable."

The lawsuit, filed by the California Attorney General and the District Attorneys of Los Angeles, Napa, San Francisco and Sonoma counties with support from the California Privacy Protection Agency, alleges that from 2016 to 2024, General Motors collected and kept driver- and driving-related data from hundreds of thousands of Californians who had subscribed to OnStar, a vehicle connectivity service offered by General Motors. This data included names, phone numbers, home addresses, speeds, rapid acceleration, and hard braking, as well as the GPS location of where OnStar subscribers drove and parked their vehicles.

General Motors allegedly affirmatively told OnStar subscribers that it did not sell any driving or location data and that their data would only be used for OnStar services, like summoning an ambulance, providing driving directions or improving driver skills.

In 2020, GM allegedly began selling this data to two data brokers, LexisNexis Risk Solutions and Verisk Analytics, Inc., deceiving consumers by not adequately disclosing that such data would be sold to third parties and not providing an opportunity to opt out of the information sharing.

General Motors reportedly earned approximately $20 million nationwide from these data sales.

"Your data isn't free, and no one has the right to sell your data without your consent," said District Attorney Hochman. "I encourage California consumers to read the fine print and exercise your right to stop companies from collecting, sharing or selling your data."

Under the settlement, subject to court approval, General Motors must pay civil penalties totaling $12.75 million. With respect to California OnStar customers, General Motors must:

• Stop selling driving data to any consumer reporting agencies for five years, including to data brokers like Lexis and Verisk;
• Delete any driving data retained by the company within 180 days, except for certain limited internal uses, absent affirmative, express consent from consumers;
• Request Lexis and Verisk delete driving data;
• Develop and maintain a robust privacy program that is required to assess, mitigate, and document the risks of collecting data through OnStar and ensure that General Motors complies with the California Consumer Privacy Act;
• Report its privacy assessments to the California Department of Justice, the California Privacy Protection Agency and the district attorneys' offices of Los Angeles, Napa, San Francisco and Sonoma counties.

Assistant Head Deputy District Attorney Steven Wang and Deputy District Attorney Louis Morin of the Consumer Protection Division handled the case on behalf of the Los Angeles County District Attorney's Office.

General Motors resolved the matter without admitting liability.

Look Under the Hood

Consumers have the right to request a report to find out if your personal data is being collected and how it is being used.

Request your LexisNexis report: consumer.risk.lexisnexis.com/consumer.

Request your Verisk report: fcra.verisk.com/#/.

DROP Out of Data Collection

The California Consumer Privacy Act (CCPA) vests California consumers with control over the personal information that businesses collect about them, including the right to request that businesses stop selling or sharing their personal information. For more information about the CCPA, visit oag.ca.gov/ccpa. To report a violation of the CCPA to the Attorney General, consumers can submit a complaint online at oag.ca.gov/report.

Californians can now send one request to more than 550 registered data brokers to delete their personal data by using a new, easy-to-use online tool. The Delete Request and Opt-out Platform (DROP), developed by the California Privacy Protection Agency, gives Californians more control over their personal information and helps limit the information that data brokers sell. For more information about DROP and how Californians can submit a deletion request, visit: privacy.ca.gov/drop.