General Motors Agrees to $12.75 Million Settlement in Consumer Protection Case

General Motors to Pay $12.75 Million in Data Privacy Settlement

General Motors (GM) has agreed to pay $12.75 million to settle a civil lawsuit accusing the company of unlawfully selling the personal information and driving data of OnStar subscribers to third-party data brokers from 2020 to 2024. Officials announced the settlement on Friday, emphasizing violations of California privacy, false advertising, and unfair competition laws.

The lawsuit, brought forth by the California Attorney General and District Attorneys from Los Angeles, Napa, San Francisco, and Sonoma counties, with support from the California Privacy Protection Agency, claims GM collected and retained extensive driver-related data from OnStar subscribers between 2016 and 2024.

The information in question included names, phone numbers, home addresses, driving behaviors such as speeds, rapid acceleration, hard braking, and GPS locations for the OnStar users’ vehicles.

"This settlement makes clear that car companies cannot secretly speed off with your personal data for profit," said Los Angeles County District Attorney Nathan J. Hochman. He underscored the fundamental privacy rights consumers hold, stating that these rights extend beyond the confines of their vehicles. He expressed appreciation for the collaborative efforts that brought GM to accountability.

The lawsuit asserts that GM misled OnStar subscribers by claiming they did not sell driving or location data, stating that personal information would only be used for OnStar services such as emergency assistance and navigation enhancements.

Starting in 2020, GM allegedly began selling this data to data brokers LexisNexis Risk Solutions and Verisk Analytics, failing to adequately disclose these transactions to consumers and lacking an opt-out option for data sharing.

The company reportedly generated about $20 million nationwide through these data sales. Hochman remarked, "Your data isn’t free, and no one has the right to sell it without your consent," encouraging California consumers to be vigilant regarding their privacy rights.

As part of the settlement, with court approval pending, GM is required to implement several measures:

• Cease selling driving data to consumer reporting agencies, including brokers like Lexis and Verisk, for five years.
• Delete any retained driving data within 180 days, barring express consent from consumers for limited internal use.
• Request that Lexis and Verisk delete driving data associated with GM.
• Establish a robust privacy program to assess and mitigate risks related to data collection via OnStar, ensuring compliance with the California Consumer Privacy Act.
• Report privacy assessments to the California Department of Justice and the relevant District Attorneys’ offices.

This settlement not only marks a significant step in consumer data protection but also aims to reinforce compliance among companies operating in California.