GM Made $20M Selling Your Driving Data. The Fine Was $12.75M.
On May 8, 2026, the California Privacy Protection Agency announced a $12.75 million settlement with General Motors — the largest CCPA penalty issued to date. The violation: OnStar, the connected-car service GM sells as a safety feature, collected drivers' location and driving-behavior data and sold it to LexisNexis Risk Solutions and Verisk Analytics — two firms that feed consumer-reporting and insurance-underwriting pipelines — without the consent the California Consumer Privacy Act requires. GM's own revenue from those sales, 2020 through 2024: roughly $20 million.
Do that math before you read the headline number as a deterrent. $12.75 million against $20 million in take is not a company losing money on the violation. It's a company keeping most of what it made.
The mechanics, in order:
Drivers pay for OnStar — marketed and sold as an emergency-response and navigation service, not a location-tracking subscription. OnStar collects continuous location and driving-behavior data (speed, braking, hard cornering — the kind of behavioral profile insurers pay to see). GM sold that data to LexisNexis Risk Solutions and Verisk Analytics, companies whose business model is packaging consumer data for insurance underwriting and background-check products. Consumers were not meaningfully told this was happening, and CCPA's consent requirement was not met. The settlement requires: a five-year ban on selling driving data to consumer reporting agencies, deletion of retained driver data within 180 days absent consent, and a request — not a guarantee — that LexisNexis and Verisk delete what they already have.
That last point is worth sitting with. GM is required to ask the data brokers to delete data GM already handed them. Not compel. Ask. The settlement can order GM's own conduct going forward; it has no direct leverage over what LexisNexis and Verisk already built from four years of driving profiles already ingested into risk-scoring products that may already have priced someone's insurance premium.
Here's the part that should bother anyone who owns a connected car, not just anyone who owns a GM: OnStar subscribers paid a monthly fee for a service they believed existed to protect them in a crash. Instead, the same telemetry stream that would call for help if you crashed was also being sold to the exact industry that decides what your insurance costs once it knows how you drive. You paid GM to watch you, and GM sold the watching.
$12.75 million is the largest CCPA settlement on record, which makes it real and also makes it worth asking what "record" actually buys. Divide it across the millions of OnStar subscribers whose data moved through this pipeline over four years, and the per-person cost to GM approaches noise. A regulator can set a record and a company can still book the fine as a line item, if the take was large enough and the bill arrived four years after the money was already banked.
GM: you sold what people paid you to protect. A five-year sales ban and a deletion deadline is a start, not an ending — and "ending" only happens if LexisNexis and Verisk actually delete what you already gave them, which this settlement can request but not force. Watch what "deleted" means in 180 days. That's where this either becomes accountability or becomes another number that looked bigger in the press release than it ever was in the bank account.