Takeaways from California’s Record $12.75 Million GM Privacy Settlement, Daniel Goldberg
Takeaways from California’s Record $12.75 Million GM Privacy Settlement, Daniel Goldberg
Publish Date: 2026-05-08 20:47:00
Source Domain: technologylaw.fkks.com
On May 8, 2026, California Attorney General Rob Bonta, together with the District Attorneys of San Francisco, Los Angeles, Napa, and Sonoma Counties, and with support from CalPrivacy, announced a $12.75 million settlement with General Motors LLC and OnStar LLC (collectively “GM” to resolve alleged violations of the CCPA, the Unfair Competition Law, and the False Advertising Law. The settlement, subject to court approval, arises from GM’s alleged collection and sale of driving and location data from hundreds of thousands of California consumers through its OnStar connected vehicle service to two data brokers without adequate notice or consent. You can read the complaint here and the proposed settlement here. Below are some key observations.
1. The Massive Penalty
At $12.75 million, this is by far the largest CCPA penalty in California history, nearly five times the prior record set by the Disney settlement earlier this year. The penalty is also only part of the story. The settlement imposes substantial injunctive obligations on GM going forward, including restrictions on how it collects, uses, and shares connected vehicle data. Particularly notable is the contrast with the FTC, which in January 2026 finalized an order settling substantially similar allegations against GM with no monetary penalty. California is not standing still, and I don’t see federal privacy preemption happening anytime soon.
2. The First True Connected Vehicle Case
There have been prior CCPA actions involving automakers but those arose from alleged opt-out and website violations. This case is specifically about vehicle-generated data, including precise geolocation, hard braking, hard acceleration, speed threshold crossings, seat belt usage, late-night driving, and trip time and duration. If you manufacture, sell, service, or build software for connected vehicles, this case is directly applicable to you.
3. A Perfect Storm of Violations
Even if you aren’t in the…
