When It Comes to Data Privacy, Consumers Must Be in the Driver’s Seat: Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement

May 8, 2026 Contact: (916) 210-6000, agpressoffice@doj.ca.gov Largest CCPA penalty in California history to date and first data minimization case  OAKLAND — California Attorney General Rob Bonta, together with San Francisco County District Attorney Brooke Jenkins, Los Angeles County District Attorney Nathan J. Hochman, Napa County District Attorney Allison Haley, and Sonoma County District Attorney Carla Rodriguez, and with support from the California Privacy Protection Agency (CalPrivacy), today announced a settlement with General Motors (GM) regarding its illegal sale of hundreds of thousands of Californians’ location and driving data to two data brokers in violation of the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law. The settlement, which is subject to court approval, includes $12.75 million in civil penalties and strong injunctive terms, including restrictions on its use of consumer driving data and a ban on such data being sold to data brokers. “General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so. This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians,” said Attorney General Rob Bonta. “Today’s settlement requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California’s privacy law — companies can’t just hold on to data and use it later for another purpose. I am proud to go to bat for the privacy rights of Californians and to collaborate with state and local partners who share the same commitment to consumer protection.”  “Modern cars are rolling data collection machines,” said San Francisco District Attorney Brooke Jenkins. “Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are. Those duties fall on the automobile companies. This case sends a strong message that law enforcement will take action when California privacy laws are not scrupulously followed. I want to extend my appreciation to both the Attorney General’s Privacy Unit and to CalPrivacy for their work in this field, and my fellow District Attorneys for taking action to enforce and protect California’s privacy laws.” “It is patently illegal to secretly sell consumers' personal data,” said Los Angeles County District Attorney Nathan J. Hochman. “To car companies who want to speed off with your data without your consent, these penalties should serve as a warning: No matter how big of a company you are, you will be held accountable in California. We appreciate the California Attorney General, our partner District Attorneys and the California Privacy Protection Agency for working with us to stand up for consumers.” “If you know the precise location of a person’s car, then you know an enormous amount of personal, sensitive information about that person — their home, work, children’s school, place of worship. There are legitimate reasons that California drivers would want to share such information with their car company, like receiving emergency roadside assistance, but Californians are entitled to know exactly what kind of data is being collected, how such data will be used, and whether they have the right to not share that information,” said Napa District Attorney Allison Haley. “When companies misrepresent their data collection practices to consumers, as GM did here, my office will take enforcement action. Our office is pleased to have worked alongside our fellow district attorneys and the Department of Justice to resolve this case.”  “I am proud to have partnered with the California Attorney General, CalPrivacy, and my fellow District Attorneys, to bring this important action to protect the privacy rights of California consumers,” said Sonoma County District Attorney Carla Rodriguez. "This settlement reflects the power of coordinated enforcement, and CalPrivacy appreciates the close collaboration with the other enforcement agencies in bringing this case to a strong resolution,” said Tom Kemp, Executive Director of CalPrivacy. “California’s privacy laws are clear: companies must collect only what they need, use it responsibly, and be forthright with consumers about how their data is handled."  BACKGROUND In 2023, CalPrivacy announced investigations into the privacy practices of connected vehicles and began engaging with GM and other car manufacturers. In 2024, while those investigations were underway, the New York Times reported that automakers, including GM, were sharing consumers’ driving behavior with insurance companies. The reporting noted that some insurers had raised consumers’ rates based on this data. Shortly after, the California Department of Justice (DOJ) partnered with the District Attorneys of Los Angeles, Napa, San Francisco, and Sonoma, with support from Ca