You Agreed to Be Watched: The $12.75 Million GM Settlement Exposes the Dark Side of ‘Smart’ Cars

 

 You Agreed to Be Watched: The $12.75 Million GM Settlement Exposes the Dark Side of ‘Smart’ Cars

**Subtitle:** From a $20 million secret profit to a 24/7 GPS tracker, the OnStar scandal reveals a brutal truth: connected cars are data mines on wheels. Here is why the record CCPA fine is a warning to every driver—and what you can do to take back control.

**OAKLAND, Calif.** – At its core, the promise of General Motors’ OnStar program was simple: a guardian angel for your car. Press a button, or crash unexpectedly, and a human operator would be there to summon help, guide you home, or unlock your doors remotely. For millions of drivers, it felt like safety.

But behind the soothing voice of the operator was a silent, far more profitable engine—one that had nothing to do with helping you and everything to do with selling you.

On Friday, May 8, 2026, California Attorney General Rob Bonta, along with a coalition of district attorneys and the California Privacy Protection Agency, announced a record $12.75 million settlement with General Motors. The charge? The automaker had secretly sold the precise driving and location data of hundreds of thousands of Californians to data brokers for years, all while telling customers that it would never do such a thing .

This is the largest penalty ever imposed under the California Consumer Privacy Act (CCPA) . It is also the first enforcement action targeting the principle of "data minimization"—the common-sense idea that a company shouldn't hold onto your data forever just in case it finds a way to profit from it later .

The $12.75 million fine is a headline. But the real story is the $20 million GM reportedly made from these sales . The real victims are the drivers whose daily habits—where they live, work, pray, and park—were turned into a commodity.

This article breaks down the OnStar scandal: how the betrayal worked, why the fine is just the beginning, and what the $7.7 trillion connected car market means for your privacy.

## Part 1: The ‘Smart Driver’ Trap – How GM Tricked Its Owners

The betrayal unfolded in plain sight, hidden in plain language and an app most people never thought twice about.

### The Promise vs. The Reality

Between 2020 and 2024, GM collected a staggering amount of data from hundreds of thousands of Californians through the OnStar Smart Driver program and companion apps like myChevrolet and myCadillac .

The data was hyper-personal:

- **Your Name, Phone Number, and Home Address** – The basic keys to your identity .

- **Your Driving Habits** – How fast you accelerated, how hard you braked, the times you drove .

- **Your Exact GPS Location** – Where you started, where you stopped, where you spent your nights .

GM told customers this data was for "improving driver skills" and "vehicle diagnostics." But in the fine print, buried in a consent agreement that most drivers clicked without reading, was a dangerous clause allowing the data to be shared with unspecified "third parties."

What GM did not tell customers, as the Attorney General’s office alleges, was that those third parties were data brokers—Verisk Analytics and LexisNexis Risk Solutions—who were explicitly in the business of packaging driving habits to sell to insurance companies .

GM reportedly earned approximately $20 million nationwide from these sales .

### The ‘We Don’t Sell Data’ Lie

The most damning piece of evidence is GM’s own privacy policy. According to the complaint, GM’s policy explicitly stated that it did NOT sell any driving or location data and that if it did disclose any such data for insurance purposes, it would be at the consumer’s express direction .

By selling the data to Verisk and LexisNexis without telling the driver, GM was not just violating a vague ethical principle. It was allegedly lying to its customers in writing.

| **"Legal" Justification** | **The Alleged Reality** |

| :--- | :--- |

| Data used only for "improving driver skills" | Data sold to insurers to rate your risk . |

| "We do not sell your driving data" | Data sold to brokers making driver-rating products . |

| Data shared only with your "express direction" | Data sold without explicit notification . |

| It's just for vehicle diagnostics | It's a $20 million revenue stream . |

### The ‘Insurance Black Box’ You Didn't Know You Had

For drivers outside of California, the consequences were even more severe. The state’s investigation found that insurers in other states were using this driver-rating data to justify premium increases . Your safety score was being used against you.

In states with fewer protections, if you drove a GM car and used OnStar, you were effectively driving around with a black box that reported back to your insurance company—without your knowledge or your consent .

## Part 2: The Historic Fine – Why $12.75 Million is a Watershed Moment

At first glance, a $12.75 million penalty against a company that made over $20 million secretly selling the data might seem like a break-even proposition for GM .

But the judgment goes far deeper than the dollar amount.

### The Largest CCPA Penalty in History

This is by far the largest penalty ever imposed under the California Consumer Privacy Act (CCPA), nearly five times the prior record .

But more importantly, this is the first time the law has been used to enforce **data minimization**. The CCPA, updated in 2023, prohibits companies from holding onto personal information for longer than necessary or using it for unspecified purposes . GM kept the driving and location data long after the OnStar service was used, then sold that retained data to brokers . That is a violation of the principle that "companies can’t just hold on to data and use it later for another purpose" .

### The Injunction – What GM Must Actually Do

The fine is a slap on the wrist. The *injunction* is the real punishment.

Under the terms of the settlement, GM must :

1.  **Stop Selling Data for Five Years:** GM cannot sell driving data to any consumer reporting agency, including LexisNexis and Verisk, for half a decade .

2.  **Delete Everything:** GM must delete any driving data it currently retains within 180 days .

3.  **Call the Brokers:** GM is required to formally request that LexisNexis and Verisk delete the data they already bought .

4.  **Build a Privacy Program:** GM must implement a CCPA-compliant privacy program, with third-party assessments, designating specific employees to handle data requests .

**The Federal Contrast:**

It is worth noting that the Federal Trade Commission finalized a similar order against GM earlier in 2026 with **zero monetary penalty** . California’s willingness to step in and levy a massive fine shows that states are not waiting for federal action. If you do business in California, the state is watching.

| **Aspect** | **Details** |

| :--- | :--- |

| **Total Civil Penalty** | $12.75 Million (Largest CCPA penalty ever) |

| **GM's Estimated Revenue from Sales** | ~$20 Million nationwide |

| **Data Brokers Involved** | LexisNexis, Verisk Analytics |

| **Data Sold** | GPS location, driving behavior, contacts, addresses |

| **Time Period** | 2020–2024 (Smart Driver program) and 2016–2024 (data retention theoretically) |

| **Key Legal Breakthrough** | First CCPA enforcement of "data minimization" . |

## Part 3: The Human Toll – Why a ‘Precise Location’ Reveals Your Entire Life

To understand why this matters, you have to stop thinking about data as "digital exhaust" and start thinking about it as a biography.

### You Are Where You Park

"Once the precise location of a vehicle is revealed, all sorts of sensitive information can be gleaned, including where people live, work, go to school or church," said San Francisco District Attorney Brooke Jenkins .

GM knew which doctors you visited. It knew which political rallies you attended. It knew when you went to the liquor store and when you went to the recovery meeting. It knew if you stayed overnight at a hotel, and which hotel.

### The Insurance Feedback Loop

For drivers in states with less regulation, the consequences were immediate and financial. The data sold by GM was used to create "driver-risk scores." If you braked hard to avoid a deer, your score went down. If you accelerated quickly to merge onto a highway, your risk profile increased.

Months later, you might receive a letter from your insurance company. Your premium had gone up. Not because of an accident or a ticket, but because of a metric you never agreed to track.

As the New York Times reported in its 2024 investigation into automaker data sales, some insurers had been raising consumer rates based on this exact data, unbeknownst to the driver .

## Part 4: The Bigger Picture – The $7.7 Trillion Data Minefield

The GM scandal is not an isolated incident. It is a feature of the modern automotive industry.

### The ‘Rolling Data Machine’

"Modern cars are rolling data-collection machines," Jenkins said .

Every Ford, Toyota, Tesla, and Hyundai equipped with a navigation system or a mobile app is capable of tracking you. Many are doing it. Some are selling it.

The connected car market is projected to be worth $7.7 trillion by 2035 . The hardware is subsidized by the collection and resale of driver data.

### The Insider Lonergan Act

This scandal has galvanized federal lawmakers. In January 2026, Senators Ron Wyden and Ed Markey reintroduced the **"Insider Lonergan Act"** —a bill that would ban automakers from selling driver data to insurance companies.

The bill would require express written consent before any biometric, location, or driving data is shared with a third party. So far, it has stalled. The GM scandal may be the pressure needed to push it over the finish line .

## Part 5: The Consumer Action Plan – How to Protect Yourself Now

You don't have to wait for Congress or a class action lawsuit. There are concrete steps every American driver (not just GM owners) can take today to stop the bleeding.

### Step 1: Request Your Data (The ‘Verisk’ & ‘LexisNexis’ Reports)

You are legally entitled to know what these brokers know about you. Under the Fair Credit Reporting Act, you can request a free disclosure.

- **LexisNexis:** Visit their consumer disclosure portal and request your CLUE (Comprehensive Loss Underwriting Exchange) report. This will show you any driving data they have on file .

- **Verisk:** Use their FCRA portal to request your driving data report .

If you find errors—or evidence of data you never consented to share—you have the right to dispute it.

### Step 2: Opt Out of OnStar & Data Sharing

- **For GM Owners:** Call OnStar directly at 1-888-466-7827 or log into your brand’s app (myChevrolet, myGMC, etc.) and navigate to **Settings > Vehicle Data Sharing**. Turn off everything labeled "Driving Behavior" or "Smart Driver."

- **For All Drivers:** Search your vehicle’s infotainment settings for terms like "Connectivity," "Vehicle Data," or "Location Sharing." Turn them off. If you can't find the setting, check your owner's manual or call the dealer.

### Step 3: Use the DROP Program (For California Residents)

California has a secret weapon: The **Delete Request and Opt-out Platform (DROP)** run by the California Privacy Protection Agency. It allows residents to send a single request to more than **575 registered data brokers** to delete their personal data . Go to **privacy.ca.gov/drop** .

### Step 4: Join the Federal Class Action

This settlement returns money to the state, not to you . However, a separate federal class action lawsuit covering an estimated 16 million GM drivers nationwide is ongoing in the Northern District of Georgia . That lawsuit may result in direct cash payments to affected drivers .

A data privacy attorney can evaluate your eligibility for free. If you saw unexplained insurance rate hikes after 2020, you may have a claim .

| **Action** | **Why It Matters** |

| :--- | :--- |

| **Check your LexisNexis report** | See exactly what driving data was sold to insurers . |

| **Opt out of OnStar data sharing** | Stop the transmission of future driving behavior . |

| **Join the Federal Class Action** | Seek monetary compensation for data sold without consent . |

| **California DROP Program** | Mass-delete your data from 575+ brokers at once . |

## Frequently Asking Questions (FAQs)

### Q1: How do I know if GM sold my data?

If you owned or leased a Chevrolet, GMC, Buick, or Cadillac with OnStar between 2020 and 2024, and you used the Smart Driver feature or the myBrand app, there is a strong possibility your data was sold . The official California settlement covers "hundreds of thousands of Californians." To know for sure, request your LexisNexis Consumer Disclosure Report .

### Q2: Will I get a check from the $12.75 million settlement?

**No.** The $12.75 million goes to the State of California as a civil penalty. There is no claim form for individual consumers in this specific enforcement action .

### Q3. How much money did GM make selling my data?

Reportedly, GM earned about **$20 million nationwide** from selling data to LexisNexis and Verisk .

### Q4. Is this just a GM problem?

No. The California Privacy Protection Agency launched investigations into the privacy practices of *all* connected vehicles . Other automakers (Ford, Toyota, etc.) are under scrutiny. However, this specific historic settlement is only with GM .

### Q5. Can I sue GM myself?

You may not need to. A **federal class action** is already underway and may cover you. Joining the class action costs you nothing, and you may be entitled to damages if the court rules in favor of consumers. Check with a consumer protection attorney for the latest status of that case .

## Conclusion: The ‘Right to Silence’ Behind the Wheel

The GM OnStar settlement is a landmark not because of the dollar amount, but because of the legal principle it establishes. The "data minimization" rule means that just because a car *can* collect data doesn't mean it has the right to *keep* it.

**The Human Conclusion:** For the nurse driving home from a night shift, the GPS track was a digital fingerprint of her exhaustion. For the suburban parent, the hard braking data was a record of a close call. For the churchgoer, the Sunday morning location was a marker of faith. None of them consented to having that intimate biography sold.

**The Professional Conclusion:** The $12.75 million fine is a shot across the bow of the entire auto industry. The connected car market is worth trillions, but the regulators are now watching. If you collect it, you must protect it. If you sell it, you must say so.

**The Viral Conclusion:**

> *"GM told you OnStar was a guardian angel. It was actually a sales agent. It tracked your speed, your brakes, and your parking spots, and it sold them to insurance companies. You were the product. The $12.75 million fine is the receipt."*

**The Final Line:**

The car in your driveway is a computer. The computer is a sensor. The sensor is watching you. The GM settlement is a reminder that in the world of connected cars, the customer isn't the only buyer of your data—and sometimes, you're not the customer at all.

---

*Disclaimer: This article is for informational and educational purposes only, based on the California Attorney General’s press release and court filings as of May 10, 2026. The settlement is subject to court approval. If you believe you have been harmed, you should consult an attorney regarding the active federal class action.*