In the largest proposed settlement under the California Consumer Privacy Act (CCPA) to date, General Motors LLC and its subsidiary OnStar will pay $12.75 million in civil penalties for allegedly collecting, retaining and later selling driver- and driving-related data from hundreds of thousands of California OnStar subscribers. The May 8 enforcement action filed by the California Attorney General and district attorneys of several counties, with the support of California Privacy Protection Agency (CPPA) asserts violations of the CCPA, California’s Unfair Competition Law and California’s False Advertising Law. The complaint alleges that from 2016 to 2024 GM collected and retained data including names and contact information, driving behavior, and GPS location information showing where consumers drove and parked, and in 202 sold the data to third-party data brokers. The proposed final judgment also requires GM and OnStar to agree to a five-year moratorium on the sale of data to consumer reporting agencies, to submit privacy assessments to the state, and to delete or destroy certain previously retained data. Key Takeaways California’s enforcement action against General Motors and OnStar is more than a connected-car case. It illustrates how California regulators are thinking about data monetization, sensitive personal information, purpose limitation, data minimization and the practical limits of a notice-and-consent privacy model. - The lawsuit is the first brought to enforce the CCPA’s data minimization principle. The California Attorney General alleged that GM retained driving and location data longer than necessary to provide OnStar and Smart Driver services, and then sold that data for a purpose that was unrelated to the reason the data was collected. - The complaint treats purpose limitation as a substantive restriction, not merely a disclosure obligation. The complaint specifically states that even if GM had disclosed the insurance-related use, developing an unrelated driver-rating service would not have been