Overview

General Motors (GM) has agreed to pay $12.75 million to resolve a lawsuit in California regarding the unauthorized sale of driver location and behavior data. The settlement follows allegations that GM sold sensitive information about drivers without their consent, violating the California Consumer Privacy Act.

The settlement mandates that GM cease selling driver data to consumer reporting agencies for a period of five years and delete existing driving data within 180 days, with certain exceptions for internal use.

Key details

  • GM will pay $12.75 million as part of a settlement with California.
  • The lawsuit claimed GM illegally sold drivers' behavior and location data.
  • The California Consumer Privacy Act was violated by selling sensitive personal information without consent.
  • California Attorney General Rob Bonta announced the settlement, marking it as the largest penalty under the Consumer Privacy Act in the state.
  • GM is required to stop selling driver data to consumer reporting agencies for five years.
  • Data must be deleted within 180 days, except for limited internal uses.
  • The allegations state GM sold data from 2020 to 2024, affecting hundreds of thousands of Californians.
  • GM reportedly made approximately $20 million from these data sales.
  • California drivers were not impacted by increased insurance rates due to GM's data sales, thanks to state laws prohibiting such practices.
  • The investigation into GM began after reports emerged about automakers sharing driving behavior data with insurance companies.
  • A specific case involved a driver discovering their credit report contained detailed driving information.
  • GM stated that the settlement addresses a product they discontinued in 2024 and emphasizes their commitment to privacy practices.

Context

The California Consumer Privacy Act was enacted to protect consumers' sensitive personal information and requires businesses to be transparent about their data practices. This settlement reflects ongoing concerns regarding data privacy and the use of personal information by corporations.

What happens next

Following the settlement, GM will implement the required changes to its data practices and will cease the sale of driver data as stipulated in the agreement.

What we don't know yet

Details regarding the specific internal uses of data that GM is allowed to retain after the 180-day deletion period are not confirmed. Additionally, the full impact of this settlement on GM's business practices and consumer trust remains unclear.