Following its settlement with the FTC earlier this year over its sale of drivers’ data to brokers, General Motors has now also reached a settlement in California. The company agreed to pay $12.75 million in civil penalties to settle the lawsuit led by Attorney General Rob Bonta on behalf of the people of California, and is banned from selling driving data to consumer reporting agencies for five years. The lawsuits came after a 2024 New York Times report revealed that GM collected consumers’ driving data through its OnStar program and sold this information to data brokers Verisk Analytics and LexisNexis Risk Solutions, which in turn could market the data to auto insurers.

In some cases, that driving data could be used by insurers to increase customers’ rates. However, in California, customers were likely spared this consequence, as laws in the state prohibit insurers from using driving data in this way. Nevertheless, the complaint alleges that GM violated consumers’ privacy by nonconsensually selling data that included people’s names, contact information, geolocation data and driving behavior data.

The settlement agreement stipulates that GM must delete any driving data it’s retained within 180 days “except for certain limited internal uses,” unless it has the customer’s express consent. It also requires GM to develop a privacy program to assess the risks of collecting data through OnStar, and report its findings to the DOJ and other agencies. In a statement on Friday, Bonta said, “Today’s settlement requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California’s privacy law — companies can’t just hold on to data and use it later for another purpose.”