GM settles California OnStar driver data privacy probe for $12.75M

Pending tribunal approval, the colony is the largest punishment ever assessed nether the California Consumer Privacy Act. At contented is information gathered from subscribers to GM's OnStar level — a work offering features similar turn-by-turn navigation and exigency dispatch — which was past sold to information brokers Verisk Analytics and LexisNexis Risk Solutions from 2020 done 2024. That information encompassed names, interaction details, GPS coordinates, and records of however customers drove. Bonta's bureau estimates GM earned astir $20 cardinal from these transactions crossed the country.

The brokers' intent was to physique products that scored drivers and marketed those scores to car insurers for rate-setting purposes. However, investigators recovered nary grounds that California policyholders saw their premiums emergence arsenic a effect of the information income — an result Bonta's bureau attributed to a authorities instrumentality that bars insurers from factoring driving behaviour information into complaint decisions.

Investigators recovered that GM gave consumers nary announcement of the information income and misled them by implying the accusation would lone beryllium utilized to supply OnStar services. GM's privateness argumentation had stated that it did not merchantability driving oregon determination data, and that immoderate disclosure for security purposes would hap lone astatine a customer's direction. GM besides retained driving and determination information beyond its operational usage for OnStar — a signifier California instrumentality prohibits — earlier selling it to the brokers.

"General Motors sold the information of California drivers without their cognition oregon consent and contempt galore statements reassuring drivers that it would not bash so," California Attorney General Rob Bonta said successful a statement.

Among the settlement's halfway requirements, GM is prohibited for the adjacent 5 years from transferring driving information to user reporting agencies, a class that includes some Verisk and LexisNexis. Within 180 days, the automaker indispensable purge immoderate driving information inactive successful its possession — absent explicit lawsuit consent to support it — and formally inquire some brokers to destruct the accusation they antecedently acquired. GM is additionally required to make and support a privateness programme and study its privateness assessments to the California Department of Justice, participating territory attorneys, and the California Privacy Protection Agency.