General Motors—GM and OnStar paid $12.75 million in largest-ever CCPA settlement for selling connected vehicle data without consent
On May 8, 2026, General Motors and OnStar agreed to a $12.75M settlement with California -- the largest CCPA penalty ever. GM collected and sold geolocation and driving behavior data from hundreds of thousands of California consumers to data brokers without adequate consent. This was the first data minimization enforcement action under CCPA, establishing that companies must limit data collection to what is reasonably necessary for the disclosed purpose.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Consumer Protection | -against | secondary | -0.50 |
| User Privacy | -against | primary | -1.00 |
| Overall incident score = | -0.664 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.59)
Evidence (1 signal)
California AG announced $12.75M CCPA settlement with GM over data minimization and purpose limitation violations
GM and OnStar collected and sold connected vehicle geolocation and driving behavior data from hundreds of thousands of California consumers to data brokers without adequate consent. This was the first data minimization enforcement action under CCPA and the largest CCPA penalty to date.