California authorities announce largest CCPA fine to date General Motors' USD12.75 million settlement covers the automaker's past data collection and sale practices related to geolocation and driving habits data. Contributors: Lexie White Staff Writer IAPP California Attorney General Rob Bonta along with the California Privacy Protection Agency and local district attorneys announced a USD12.75 million California Consumer Privacy Act settlement with General Motors over allegations of unlawful collection and sale of Californians' driving and location data. The settlement represents the largest CCPA fine ever issued. A joint investigation looked into GM's handling of data collected through its OnStar Smart Driver connected vehicle services. The automaker allegedly sold drivers' geolocation data, driving behavior data and other personally identifiable information to data brokers, including Verisk Analytics and LexisNexis Risk Solutions, without obtaining consumer consent. "We're talking about data that not only shows how a person drove, but also precisely where they drove, which could easily be used to paint a picture of their everyday habits and movements," Bonta said during a press conference. He added while GM's privacy notices stated the company would not sell driving or location data, the company "kept driver's data beyond what is needed for OnStar services … and then sold it with the intent to use it for insurance rate setting." The settlement includes corrective measures, including commitments to stop selling consumer driving data to credit reporting agencies for five years, delete specific driving data collected within the last 180 days and request that data brokers delete consumer data sold by GM. In a statement to the IAPP, a GM spokesperson indicated it discontinued the Smart Driver program in 2024 due to customer feedback while also ending collaborations with data brokers LexisNexis and Verisk. They said the settlement "reinforces steps we've taken to strengthen our privacy practices."