California AG Announces Record $12.75M Settlement with GM over CCPA Data Minimization and Purpose Limitation Violations
Publish Date: 2026-05-14 14:00:00
Source Domain: www.hunton.com
California AG Announces Record $12.75M Settlement with GM over CCPA Data Minimization and Purpose Limitation Violations
On May 8, 2026, the California Attorney General announced a record $12.75 million settlement with General Motors (“GM”) to resolve allegations that GM illegally sold Californians’ location and driving behavior data without adequate notice or consent, in violation of the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law. The settlement is subject to court approval and represents the largest CCPA penalty to date. This is the first CCPA settlement focused on the law’s data minimization and purpose limitation requirements.
The Attorney General alleged that GM sold driver data, including names, contact information, precise geolocation information, and driving metrics, such as speed, hard braking and rapid acceleration, to LexisNexis Risk Solutions and Verisk without adequate notice or consent, and for purposes unrelated to the original, disclosed uses, in violation of the CCPA’s data minimization and purpose limitation requirements.
Under the settlement, in addition to the $12.75 million penalty, GM agreed to (i) stop selling driving data to consumer reporting agencies for five years, including to data brokers such as LexisNexis and Verisk; (ii) delete retained driving data within 180 days absent affirmative, express consumer consent; (iii) request deletion of driving data by LexisNexis and Verisk; (iv) develop and maintain a robust privacy program to assess, mitigate and document privacy risks; and (v) complete privacy assessments and comply with certain reporting requirements with respect to such assessments.
The California Attorney General’s action follows a 2025 FTC order prohibiting GM and OnStar from sharing sensitive geolocation and driver behavior data with consumer reporting agencies for five years, along with enforcement actions by regulators in Nebraska and Arkansas over GM’s alleged privacy…
