California Attorney General Rob Bonta announced a $12.75 million settlement with General Motors on May 8, 2026, after the automaker sold driving and location data from hundreds of thousands of California drivers to Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024. GM made roughly $20 million nationwide selling that data to insurance industry brokers.
General Motors will pay $12.75 million to settle California's first data minimization enforcement case, state officials announced Friday, after an investigation found the automaker sold location and driving behavior data from hundreds of thousands of California drivers to two of the auto insurance industry's biggest data brokers, Verisk Analytics and LexisNexis Risk Solutions, between 2020 and 2024. The penalty is the largest in the seven-year history of the California Consumer Privacy Act.
California drivers will not get refunds because Proposition 103, passed in 1988, bars insurers in the state from using driving data to set rates. Drivers in 47 other states had no such protection, and several saw their premiums climb after the same broker-built risk scores reached their carriers.
- $12.75 million civil penalty, the largest CCPA fine since the law took effect in 2018
- Sale period ran from 2020 to 2024 and produced about $20 million in nationwide GM revenue
- Buyers Verisk and LexisNexis intended to package the data into driver risk-rating products marketed to insurers
- GM is banned from selling driving data to data brokers for five years and must delete retained data within 180 days
- Only California, Hawaii, and Massachusetts ban insurers from using driving data to set rates
What the Settlement Requires
AG Bonta filed the settlement Friday alongside the California Privacy Protection Agency and four county district attorneys: Brooke Jenkins of San Francisco, Nathan Hochman of Los Angeles, Allison Haley of Napa, and Carla Rodriguez of Sonoma. The agreement is subject to court approval. Beyond the $12.75 million penalty, GM accepted a five-year ban on selling driving data to consumer reporting agencies or data brokers, including Verisk and LexisNexis, and the automaker must delete retained driving data within 180 days except for limited internal uses with affirmative consumer consent.
GM has to formally request that Verisk and LexisNexis delete the data they purchased, and the company must launch a new privacy program that assesses OnStar data risks and reports findings to the DOJ, the four DAs, and CalPrivacy. GM spokesperson Charlotte McCoy said the company has already discontinued the OnStar Smart Driver product at the center of the case and "taken steps to strengthen privacy practices."
"Modern cars are rolling data collection machines," said San Francisco District Attorney Brooke Jenkins. "Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are."
Why California Drivers Weren't Charged More
California's 1988 Proposition 103 forbids insurers from rating policies based on telematics or driving behavior data, so the broker products built from GM's data could not flow into California rate filings. Hawaii and Massachusetts enforce similar bans, leaving only three states out of 50 that block insurers from telematics-based pricing. Drivers in the remaining 47 states had no statutory shield against rate increases tied to broker-sourced telematics.
The 2024 New York Times investigation that triggered the probe found cases where drivers saw premium hikes after their LexisNexis driving reports flagged hard braking or late-night trips. Bonta's team confirmed CA drivers escaped financial harm but explicitly noted the settlement does not address consumers in other states whose rates may have shifted.
Other Automakers Still Under the Microscope
GM is not the only automaker selling driver data to insurance industry brokers. Earlier reporting from the New York Times and 2024 Senate letters from Ron Wyden and Edward Markey named several manufacturers in the same broker pipeline.
| Automaker | Vehicles Reported | Reported Payment | Status |
|---|---|---|---|
| General Motors | Hundreds of thousands in CA, millions nationwide | ~$20M from Verisk + LexisNexis | $12.75M CA settlement (May 2026) |
| Hyundai | 1.7 million | ~$1.04M from Verisk | Class action filed 2024 |
| Honda | 97,000 | ~$26,000 from Verisk | Senate referral to FTC |
| Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, Ram | Not disclosed | Not disclosed | Texas AG lawsuit (vs. data broker Arity) |
Sources: U.S. Senate letter to FTC (July 2024), Texas Attorney General complaint, Carscoops, Insurance Journal. Vehicle counts and payments reflect figures cited in those filings.
The January 2025 FTC order against GM banned the same conduct nationally for five years, but the federal action carried no monetary penalty. California's $12.75 million is the first cash punishment any U.S. authority has imposed on an automaker for selling driving data without consent.
What This Means for Your Insurance Rates
If you drove a GM vehicle with active OnStar between 2020 and 2024 and live outside California, Hawaii, or Massachusetts, your insurer may have received a LexisNexis or Verisk risk score built partly from your data. Those broker scores typically raise premiums when they show frequent hard braking, rapid acceleration, or late-night driving.
A 2024 Insurify analysis found drivers flagged in LexisNexis Telematics OnDemand reports paid 12% to 21% more on average than drivers without the same flags. On a $2,000 annual full-coverage premium, a 15% surcharge translates to roughly $300 per year extra.
Order your free LexisNexis CLUE Auto report at consumer.risk.lexisnexis.com and your Verisk consumer disclosure report. The LexisNexis report includes a Telematics OnDemand section that reveals whether driving behavior data has been shared with carriers in your name.
What You Should Do Now
Pull Your LexisNexis CLUE Auto Report
Visit consumer.risk.lexisnexis.com/request and order the report at no charge under the Fair Credit Reporting Act. Look for a Telematics OnDemand section that lists driving behavior data and the source automaker.
Request Your Verisk Consumer Disclosure
Verisk maintains a separate consumer disclosure portal. Filing a request forces Verisk to send a copy of any driving data attributed to you and the carriers that received it.
Submit Opt-Out Requests
Use lexisnexisrisk.com/optout and verisk.com/privacy to opt out of future data sales. California, Virginia, Colorado, and Connecticut residents have statutory rights, and insurers in other states often honor the requests anyway.
Disable Connected Vehicle Data Sharing
Open OnStar settings or the equivalent app for Honda, Hyundai, Kia, or Toyota and disable Smart Driver, Driver Score, or any opt-in telematics feature. Cancelling OnStar entirely stops new data collection.
Shop Your Renewal With Fresh Quotes
Get fresh quotes from at least three carriers. A flagged LexisNexis profile can stay attached for up to seven years, so a clean comparison may reveal carriers that price your record differently.
Looking Ahead
The Texas Attorney General's separate lawsuit against the data broker Arity is still active and names Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram as data sources. Senators Wyden and Markey requested an FTC investigation into Honda and Hyundai data practices in July 2024, and that probe has not closed.
California's Department of Insurance is reviewing whether brokers can be compelled to flag and erase driving data sourced from non-consenting drivers in other states. The NAIC also launched a national review of AI in auto insurance pricing earlier this year, with broker-sourced data among its targets. CalPrivacy executive director Tom Kemp called this settlement "the first" data minimization enforcement, signaling additional cases are queued for filing.
Frequently Asked Questions
No. The $12.75 million is a civil penalty paid to the State of California, not consumer restitution. Class action suits in other states could eventually award damages, but no consumer payments are part of this settlement.
If you owned a GM vehicle with active OnStar between 2020 and 2024, the answer is likely yes. The Smart Driver feature inside MyChevrolet, MyGMC, MyBuick, and MyCadillac apps was the primary collection point. GM has since discontinued Smart Driver.
California (under Proposition 103, 1988), Hawaii, and Massachusetts. The other 47 states permit telematics and driving behavior data in rate calculations, though most require carrier disclosure of how the data is used.
Order a free LexisNexis CLUE Auto report at consumer.risk.lexisnexis.com and a Verisk consumer disclosure. Both companies must, under the Fair Credit Reporting Act, send a copy of the file they keep on you, including any telematics data tied to your vehicle.
Yes. Under the Fair Credit Reporting Act, you can dispute inaccurate entries with LexisNexis or Verisk, and the data broker has 30 days to investigate and correct or remove the disputed information. Confirm the correction with your insurer at the next renewal.
- California Privacy Protection Agency, "AG Bonta Secures $12.75 Million GM Privacy Settlement," May 8, 2026
- Sacramento Bee, "California penalizes General Motors $12.75M for selling drivers' data," May 8, 2026
- TechCrunch, "GM agrees to pay $12.75M in California driver privacy settlement," May 9, 2026
- New York Times, "Automakers Are Sharing Consumers' Driving Behavior With Insurance Companies," April 23, 2024
- Insurance Journal, "Senators Call on FTC to Investigate Automakers' Sale of Driving Data," July 29, 2024
- Consumer Financial Protection Bureau, "LexisNexis C.L.U.E. and Telematics OnDemand"
- Federal Trade Commission, "FTC Takes Action Against GM and OnStar," January 2025
- Insurify, "High Car Insurance? Your Car Maker May Be Selling Your Driving Data"