GM's OnStar Was Quietly Selling Your Every Move — Now It'll Cost $12.75 Million
California's attorney general just handed General Motors a landmark privacy penalty for funneling driver data to brokers while telling customers their information was safe.
Written by OutOfToken AI
June 4, 2026 · 4 min read · Synthesized from reporting by TechCrunch Policy · How this works
General Motors has agreed to pay $12.75 million in civil penalties to settle California state claims that its OnStar telematics system illegally harvested and sold the personal driving data of hundreds of thousands of Californians — all while the company publicly assured drivers their data was protected. The settlement, brokered by California Attorney General Rob Bonta alongside several district attorneys, resolves litigation filed in Napa County Superior Court. Beyond the financial penalty, California is imposing hard operational restrictions on how GM can use and monetize consumer driving data going forward.
What OnStar Was Actually Doing
OnStar, GM's connected vehicle platform embedded across its Chevrolet, Buick, GMC, and Cadillac lineup, was designed and marketed as a safety and navigation service. But state investigators found that GM had quietly turned the system's rich telemetry pipeline — capturing granular location history, driving behavior, trip frequency, and vehicle diagnostics — into a revenue stream by selling that data to third-party data brokers. According to the settlement filings, GM reportedly generated around $20 million from those data sales, meaning the $12.75 million penalty represents a significant but not complete clawback of those profits. The data sold was detailed enough to reconstruct individual driving patterns with high fidelity, raising serious concerns about downstream misuse by insurers, marketers, and law enforcement.
Deception Was Central to the Case
What elevates this beyond a routine data-monetization dispute is the allegation of active deception. California's complaint asserted that GM made 'numerous statements reassuring drivers that it would not' sell their personal data — statements that regulators say were demonstrably false given the company's simultaneous data-broker relationships. That gap between public messaging and internal practice is the kind of conduct California's consumer protection framework is specifically designed to punish. It also mirrors a broader pattern regulators have identified across the connected-vehicle industry, where automakers market privacy-respecting services while embedding data-collection architectures that quietly monetize user behavior at scale.
"GM reportedly netted approximately $20 million selling OnStar driver data — California is now banning the company from selling that data to any broker for five years."
The Five-Year Freeze and What It Signals
The most consequential element of the settlement may not be the dollar figure — it's the operational ban. California is restricting GM from selling consumer driving data to data brokers for five years, a structural intervention that goes well beyond a fine and directly disrupts a revenue model the company had built into its connected-vehicle infrastructure. The restriction applies specifically to data broker sales but signals that California is willing to use its enforcement muscle not just to punish past violations but to reshape how automakers architect their data businesses. With vehicles increasingly functioning as sensor-laden data collection platforms — tracking everything from driving speed to seat occupancy and gaze direction — the GM settlement sets a concrete precedent for what regulators consider acceptable data use in the connected-car era.
The GM-OnStar settlement arrives as federal lawmakers debate national vehicle data privacy standards and as automakers across the industry quietly expand their telematics capabilities with each new model generation. California's willingness to pursue civil penalties, impose operational restrictions, and make deceptive data practices a core element of its enforcement theory puts every connected-vehicle platform on notice. GM got caught profiting from data it promised to protect — and the industry now has a $12.75 million, five-year reminder of what that calculus looks like when regulators are paying attention.
Editorial Note
GM has faced multiple privacy-related settlements in California in recent years, particularly regarding location data and telematics. TechCrunch is a reputable technology news source with established credibility. The $12.75M figure and involvement of California AG Rob Bonta align with typical settlement patterns, though specific details would require verification against official state or GM statements.
Claim Tracker
AI-assessed
Settlement amount and parties are factual and documented in official filings
Confirmed by settlement agreement; scale described as 'hundreds of thousands'
Appears in settlement filings but specific revenue figure not independently corroborated in public sources
Data types documented in OnStar system capabilities and settlement details
Claim about contradictory public messaging; specific statements not quoted or sourced in article
Ask AI about this story
// discussion
sign in to join the discussion