GM agrees to pay $12.75 million to settle California lawsuit over misuse of customers' driving data - Engadget

"General Motors has now also reached a settlement in California. The company agreed to pay $12.75 million in civil penalties to settle the lawsuit led by Attorney General Rob Bonta on behalf of the people of California, and is banned from selling driving data to consumer reporting agencies for five years."

"The lawsuits came after a 2024 New York Times report revealed that GM collected consumers' driving data through its OnStar program and sold this information to data brokers Verisk Analytics and LexisNexis Risk Solutions, which in turn could market the data to auto insurers. In some cases, that driving data could be used by insurers to increase customers' rates."

"Nevertheless, the complaint alleges that GM violated consumers' privacy by nonconsensually selling data that included people's names, contact information, geolocation data and driving behavior data. The settlement agreement stipulates that GM must delete any driving data it's retained within 180 days "except for certain limited internal uses," unless it has the customer's express consent."

"It also requires GM to develop a privacy program to assess the risks of collecting data through OnStar, and report its findings to the DOJ and other agencies. In a statement on Friday, Bonta said, "Today's settlement requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California's privacy law - companies can't just hold on to data and use it later for another purpose.""

General Motors reached a California settlement with civil penalties of $12.75 million. The settlement bans General Motors from selling driving data to consumer reporting agencies for five years. The case followed reports that driving data collected through OnStar was sold to data brokers, which could market the information to auto insurers. The complaint alleged nonconsensual sharing of data including names, contact information, geolocation data, and driving behavior. California laws were noted as limiting insurers’ ability to use driving data to raise rates. General Motors must delete retained driving data within 180 days, except for limited internal uses, unless it has express customer consent. General Motors must also create a privacy program to assess OnStar data collection risks and report findings to federal and other agencies.

Read at Engadget