A $12.75 million California settlement — the largest in the state’s history under its consumer privacy law — marks the latest reckoning for an industry that turned driver data into a commodity without telling drivers. For years, millions of Americans climbed into their General Motors vehicles, accepted the turn-by-turn navigation and roadside emergency features of OnStar, and drove on — never knowing that their precise GPS coordinates, braking habits, and acceleration patterns were being packaged and sold to data brokers who then sold driving “scores” to their insurance companies. That arrangement, which GM reportedly used to generate roughly $20 million in revenue over four years, came to a costly end last week. On May 8, California Attorney General Rob Bonta announced a $12.75 million settlement with General Motors and OnStar, resolving allegations that the automaker had illegally sold the location and driving data of hundreds of thousands of California residents to two data brokers — LexisNexis Risk Solutions and Verisk Analytics — without adequate notice or consent. The settlement, which is subject to court approval, is the largest penalty ever assessed under the California Consumer Privacy Act, a 2018 law requiring companies to disclose how they share data and to honor consumer requests to stop. “General Motors sold the data of California drivers without their knowledge or consent,” Bonta said at a news conference, “and despite numerous statements reassuring drivers that it would not do so.” It is a remarkable line. GM’s own privacy policy had stated that it did not sell driving or location data, and that any disclosure for insurance purposes would occur only at a customer’s direction. Investigators found that neither promise was kept. A Scandal Years in the Making The backstory of how GM’s data practices came to light is almost as striking as the practices