Run a free scan

General Motors: data kept after the service needs it becomes a liability when someone sells it

Set a retention limit for every data type tied to the service that collected it, and review any new use against the purpose you told people. California’s General Motors case is, in the complaint’s words, "the first lawsuit brought to enforce" the CCPA’s data minimisation rule (Complaint, ¶ 6), and the largest CCPA penalty announced to date.

California Attorney General and four District Attorneys · CCPA, UCL and FAL · Final judgment 12 May 2026

The problem

From 2016, GM collected names, contact details, speed, hard braking, rapid acceleration and GPS location from OnStar subscribers, then kept it "long past when GM needed the data". From 2020 it sold that data for hundreds of thousands of Californians to two data brokers building a driver-rating product for insurers, for about USD 20 million nationwide. GM’s privacy notice said it did not sell driving or location data (Complaint, ¶¶ 1–3, 12–13, 16).

Case record

Court
Superior Court of California, County of Napa
Case number
26CV001011 ([Judgment, p. 1](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))
Parties
The People (Attorney General; District Attorneys of Los Angeles, Napa, San Francisco and Sonoma) v. General Motors LLC and OnStar, LLC; CalPrivacy assisted
Counsel
King & Spalding LLP for GM ([Judgment, pp. 3, 15](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))
Laws
CCPA; UCL; FAL
Stage
Stipulated final judgment, filed 12 May 2026; amended penalty schedule approved 30 June 2026
Amount
USD 12,750,000 civil penalties ([Judgment, ¶ 40](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))
Source review
17 October 2026

GM stipulated without admitting liability and without any adjudication of fact or law (Judgment, p. 3). The investigation found that California drivers' premiums were not raised, likely because California bars insurers from using driving data to set rates (Announcement).

What the regulator alleged

What the regulator alleged
ClaimWhat the law requiresFacts allegedResult
Sale without notice or opt-outDisclose sales and honour opt-outs (Civ. Code §§ 1798.120, 1798.135)GM's website opt-out "had no effect on data going to Lexis or Verisk" ([Complaint, ¶ 21](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))Settled; not decided
Right to limit sensitive dataLet consumers limit use of precise geolocation (Civ. Code § 1798.121)GPS data, including where cars were parked at ignition-off, went to Lexis ([Complaint, ¶¶ 15, 22](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))Settled; not decided
Purpose limitationUse data only for the collection purpose or a disclosed, compatible one (Civ. Code § 1798.100(c); 11 CCR § 7002)Data collected for OnStar and Smart Driver was sold to rate drivers for insurers ([Complaint, ¶ 23](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))Settled; not decided
Data minimisationRetention and sharing must be "reasonably necessary and proportionate" (Civ. Code § 1798.100(c))Data kept since 2016; location sold to Lexis although its ratings did not use it; Verisk's contract barred precise location, "a red flag" ([Complaint, ¶¶ 6, 14–15, 24](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))Settled; not decided
UCL and FALNo misleading statementsEnrolment and Smart Driver notices described only service uses; the CCPA notice denied selling geolocation ([Complaint, ¶¶ 16, 20, 32](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))Settled; not decided

The complaint adds that GM did not mention the broker sales when CalPrivacy asked about connected-car data in late 2023, and could not produce the risk assessment its own 2019 privacy policy required (Complaint, ¶¶ 4, 18, 28).

What the judgment requires

Paragraphs are from the judgment. Section V runs for five years (¶ 22).

  • Consent per feature. GM must obtain consent before collecting, using or disclosing "COVERED DRIVING DATA", and "Each separate, unrelated service or feature" needs its own consent, with exceptions such as emergency responders and safety communications (¶ 25).
  • Delete the backlog. Delete prior-retained driving data within 180 days, subject to listed exceptions, unless the driver consents (¶ 26).
  • Recall from buyers. No further sales to earlier buyers until they confirm receipt of deletion instructions (¶ 27).
  • Location off switch. Let drivers disable precise location collection where the vehicle supports it (¶ 28), and stop remote collection of all data for drivers who decline or leave OnStar (¶ 29).
  • No sales to credit-reporting agencies of driving data for five years without consent (¶ 30).
  • Privacy programme for five years with assessments of non-OnStar uses and disclosures, updated before any material change (¶¶ 31–34), and four annual reports to the People and CalPrivacy, approved by GM’s Chief Privacy Officer (¶¶ 35–36).

Technical issue

  • Tools or vendors: OnStar and its Smart Driver feature; recipients LexisNexis Risk Solutions and Verisk Analytics, Inc. (Complaint, ¶¶ 2, 12).
  • Where: vehicle telematics and the GM back end; no website tracking was involved.
  • What data: names, phone numbers, home addresses, driving events, and GPS locations including ignition-off points.
  • When: sold from 2020 until GM halted sales after the March 2024 New York Times report (Complaint, ¶ 17).
  • How it came to light: press reporting, then a joint investigation that followed CalPrivacy’s 2023 connected-vehicle inquiry (Announcement).

Inth’s technical interpretation: two engineering choices made the sale possible. Driving events had no retention limit, so years of history were there to package. And the Lexis feed carried GPS while the Verisk feed stripped it because that contract said so: the field list followed contract terms, not need. A field allow-list per recipient and a retention job per data type would have limited both.

Illustrative pattern, not the defendant’s code.

# Bad: a partner feed with identity, full GPS and every event ever stored
def build_partner_feed(db):
    return db.query("""
        SELECT d.name, d.address, d.phone, e.event_type, e.speed, e.lat, e.lon, e.ts
        FROM driving_events e JOIN drivers d ON d.id = e.driver_id""")

Illustrative pattern, not the defendant’s code.

# Fixed: per-purpose consent, no location, bounded history, scheduled purge
def build_partner_feed(db):
    return db.query("""
        SELECT e.driver_id, e.event_type, e.ts
        FROM driving_events e
        JOIN consents c ON c.driver_id = e.driver_id AND c.purpose = 'partner_scoring'
        WHERE c.granted AND e.ts > now() - interval '90 days'""")

def purge_expired(db):  # retention set by what the in-car feature needs
    db.execute("DELETE FROM driving_events WHERE ts < now() - interval '90 days'")

Timeline

Timeline
DateEvent
2016Smart Driver data collection begins ([Complaint, ¶ 12](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))
2020Sales to Lexis and Verisk begin ([Complaint, ¶ 13](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))
Late 2023CalPrivacy asks GM about connected-car data ([Complaint, ¶ 4](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))
11 March 2024New York Times report; GM halts sales ([Complaint, ¶ 17](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))
8 May 2026Complaint filed; settlement announced ([Complaint, p. 1](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))
12 May 2026Final judgment signed and filed ([Judgment, pp. 1, 15](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))
30 June 2026Amended judgment approved; only the penalty distribution changed

Outcome

GM pays USD 12,750,000 within 30 days of being served with notice of entry (¶¶ 8, 40). Half is UCL penalties, USD 1,275,000 each to the four counties and the Unfair Competition Law Fund. The other half is CCPA penalties; the 30 June amendment changed only how that half is split between state privacy funds, not the total (Judgment, Schedule A; Proposed judgment, Schedule A). Each side bears its own fees (¶ 42). The release covers all privacy and consumer protection claims about the covered data (¶ 43).

What it cost

What it cost
ItemAmount or term
Civil penaltiesUSD 12,750,000 ([¶ 40](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))
Revenue from the salesAbout USD 20 million nationwide, as alleged ([Complaint, ¶ 13](https://oag.ca.gov/system/files/attachments/press-docs/May%208%2C%202026%20GM%20Complaint%20Court%20Stamped.pdf))
Data deletionAll prior-retained driving data within 180 days, with exceptions ([¶ 26](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))
Ban on sales to credit-reporting agenciesFive years ([¶ 30](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))
Privacy programme and reportsFive years; four annual reports ([¶¶ 31, 35–36](https://oag.ca.gov/system/files/attachments/press-docs/June%2030%202026%20Court%20Approved%20Amended%20Judgment%20People%20v.%20GM.pdf))

Why it matters

The Attorney General called it the "Largest CCPA penalty in California history to date and first data minimization case" (Announcement). The complaint treats holding data as regulated in itself: retention must be necessary for the purpose, and disclosing it is not enough. It also argues the federal Fair Credit Reporting Act did not exempt the sales (Complaint, ¶¶ 26–27). Like DoorDash, the sale happened entirely off the website. See undisclosed data exchanges and CCPA.

How Inth catches this

  • Code audit: where the feed is built in your codebase, data flow mapping traces location and driving fields from storage to the external destination, and flags a pull request that adds a new recipient or field.
  • Website audit: not relevant; nothing here passed through a browser.
  • Consent banner: not relevant; it governs website tags, not telematics.
  • Evidence: each Code audit finding keeps its owner, decision, rationale and approval, a contemporaneous record of who signed off a new data flow. It is not a CCPA risk assessment.

Limit: Inth does not enforce retention periods, read data-sharing contracts, or see transfers run outside the repository.

Checks for your own systems

In the repository

  • For each table of event or location data, find the deletion job. No job means no retention limit.
  • For each outbound feed, list the fields. Flag precise location sent where the recipient does not need it.
  • Check that each feed joins on a consent record for its own purpose.

In the browser and network

  • A browser cannot see this. Review data warehouse exports, partner SFTP drops and API keys issued to third parties instead.

With the people responsible

  • For each recipient, write down the purpose and compare it with what the enrolment notice says.
  • Record who approved each data sale, and when.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit General Motors' current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.