General Motors will pay $12.75 million to settle privacy violations alleged by California and other state law enforcement agencies. California Attorney General Rob Bonta led the action against the automaker.
The settlement centers on how GM collected and handled driver data through its OnStar connected vehicle service. The company allegedly failed to adequately disclose to customers how it used location data, driving habits, and other personal information. GM also faced accusations of selling customer data to third parties without proper consent and failing to implement reasonable data security practices.
OnStar, GM's telematics platform, connects vehicles to cloud services and enables features like remote diagnostics, emergency assistance, and navigation. The service collects granular information about driver behavior and vehicle location. According to the settlement terms, GM did not clearly inform subscribers about the extent of data collection or their ability to opt out of certain data uses.
The $12.75 million penalty reflects growing regulatory scrutiny of automakers' data practices. As vehicles become increasingly connected, state attorneys general are cracking down on companies that treat driver information as a commodity. Connected car services now generate vast datasets that appeal to insurers, advertisers, and other commercial entities.
GM must now implement stronger data protection measures, including enhanced transparency disclosures and clearer opt-out mechanisms for drivers. The settlement also requires the automaker to delete certain categories of customer data and conduct regular audits of its data handling practices.
This case signals broader pressure on the automotive industry. Tesla, BMW, and other connected vehicle makers face similar privacy scrutiny. Unlike social media or software companies, automakers have historically operated in a regulatory gray zone around vehicle data. The California settlement suggests that gap is closing rapidly. State-level enforcement actions may precede federal privacy legislation targeting the auto sector, setting de facto standards that other manufacturers will need to match.