General Motors will pay $12.75 million to settle a California consumer protection lawsuit that alleged the company illegally sold drivers’ behavior and location data, the state’s attorney general announced Friday. The settlement requires GM to stop selling driver data to consumer reporting agencies, including data brokers, for five years and to delete any driving data within 180 days except for limited internal uses. “We’re talking about data that not only shows how a person drove but also precisely where they drove, which could easily be used to paint a picture of their everyday habits and movements,” California Attorney General Rob Bonta said at a news conference announcing the largest Consumer Privacy Act penalty in the state’s history. Bonta alleges that from 2020 to 2024, GM illegally sold the names, contact information, geolocation data and driving behavior of hundreds of thousands of Californians without their knowledge or consent, violating a provision in the California Consumer Privacy Act that voters approved in 2020 to limit the use and disclosure of sensitive personal information collected about them. The act requires that businesses tell consumers about their privacy practices and allow consumers to opt out of their personal information being sold or shared. It also limits how sensitive personal information can be shared with third parties. The California Department of Justice alleges General Motors made approximately $20 million from selling drivers’ data. “This agreement addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices," a GM spokesperson told Spectrum News in a statement. "Vehicle connectivity is central to a modern and safe driving experience, which is why we’re committed to being clear and transparent with our customers about our practices and the choices and control they have over their information.” California began investigating GM after