General Motors (GM) and a group of California enforcement agencies led by state Attorney General Rob Bonta have reached a settlement, Bonta’s office announced on May 8, requiring GM to pay $12.75 million in penalties and follow driving data restrictions.

Bonta’s office cited a 2024 New York Times report on automakers, including GM, sharing consumers’ driving data with insurance companies, with some insurers raising customers’ rates in other states based on the data.

It said the California DOJ partnered with multiple district attorneys to investigate these reports. Its investigation found that from 2020 to 2024, GM sold the names, contact information, geolocation data, and driving behavior data of hundreds of thousands of Californians to two data brokers—Verisk Analytics and LexisNexis Risk Solutions.

“If you know the precise location of a person’s car, then you know an enormous amount of personal, sensitive information about that person—their home, work, children’s school, place of worship,” Napa District Attorney Allison Haley said.

“There are legitimate reasons that California drivers would want to share such information with their car company, like receiving emergency roadside assistance, but Californians are entitled to know exactly what kind of data is being collected, how such data will be used, and whether they have the right to not share that information.”

GM’s OnStar Smart Driver program, through which it collected the consumer data, was discontinued in April 2024. The company said it terminated relationships with LexisNexis and Verisk, and ended data sharing with these companies in March 2024.

Bonta’s office said that GM made approximately $20 million nationwide through selling consumer data to these two companies. Its investigation determined that the companies purchased the data intending to develop a product that rates drivers for insurers to set insurance rates. However, it found that while GM had sold California drivers’ data, the drivers had not been subject to increased premiums as California insurers are prohibited by state law from using driving data to set rates.

The investigation said GM still failed to give consumers any notice that their data was being sold to Lexis and Verisk and that their data was kept for longer than allowed by California law. It noted that GM said in its privacy policy it would not sell any data related to driving or location without consumer permission.

“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so,” Bonta said. “Companies can’t just hold on to data and use it later for another purpose.”

The Epoch Times reached out to GM for comment but did not receive a response by publication time.

Along with the penalties, the settlement also requires GM to stop selling driving data to consumer reporting agencies for five years, delete any driving data held by the company within 180 days, and request that Lexis and Verisk also delete the driving data. The settlement still needs court approval.

In a separate settlement with the Federal Trade Commission in January over the same consumer data allegations, GM was subject to the same five-year sales ban to consumer reporting agencies, among other requirements.

“This fencing-in relief is appropriate given GM’s egregious betrayal of consumers’ trust,” the commission said in its release.