Notes on the largest CCPA fine in history, from someone who reads these settlements for a living
Last month's General Motors settlement is worth a closer look, because the violation behind it is so simple it's almost easy to miss.
California's Attorney General, together with the California Privacy Protection Agency and four district attorneys, fined GM $12.75 million. Largest CCPA penalty ever issued — nearly five times the previous record, a $2.75 million settlement with Disney from earlier this year. And the underlying story isn't complicated at all.
From 2020 to 2024, GM collected driving and location data from OnStar subscribers — speed, hard braking, rapid acceleration, precise geolocation, contact information. The stated purpose was OnStar's own services: emergency response, navigation, the things people actually signed up for. Then GM sold that data to two data brokers, Verisk Analytics and LexisNexis Risk Solutions, who built it into driver-risk scoring products for insurance companies. GM made roughly $20 million nationwide doing this. Some drivers found their insurance premiums had moved, based on driving data they never knew was being shared.
There was no hack. No attacker, no exploited vulnerability. The data moved through a deal that GM itself put in place.
Two Rules, Both Broken in Plain Sight
Two rules carry this complaint, both added to the CCPA in 2023: purpose limitation and data minimization. Purpose limitation: use the data for what you said you'd use it for. Data minimization: stop holding onto it once that reason is gone.
GM's OnStar customers agreed to share driving data so the car could call for help and give directions. That's the deal. Selling that same data to brokers who fed it to insurers building rate-setting products falls outside that original purpose. The complaint argues that the insurance-rating purpose was never disclosed, would likely have failed the compatibility test even if it had been, and that using driving behavior for insurance rate-setting is an unlawful purpose that can't satisfy purpose limitation under any disclosure.
And the data didn't even need to still be around. GM retained Californians' driving and location data long after it was needed for OnStar services and then sold that retained data to brokers — that's the minimization half of the violation. Keeping data "just in case it's useful later" is exactly the habit the 2023 amendments were written to stop.
What the Settlement Actually Requires
The money is the least of it. GM now has five years where it can't sell driving data to consumer reporting agencies, 180 days to delete what it's already collected unless a customer asks otherwise, an order to get Verisk and LexisNexis to delete their copies too, and a privacy program with risk assessments and reporting it now has to actually run.
$12.75 million is a fine that a company of GM's size can absorb. A five-year ban on a specific revenue line, plus mandatory privacy assessments with ongoing reporting, changes how the business operates going forward.
GM had already wound down the Smart Driver program in 2024, following customer feedback, and ended its data-sharing arrangements with Verisk and LexisNexis before the settlement was announced. In a statement, the company said the agreement "reinforces steps we've taken to strengthen our privacy practices." It's also true that the wind-down happened only after a New York Times investigation and a regulatory probe were already in motion — not before.
Why This One Will Get Cited Often
California regulators have signaled that fines need to be substantial enough to serve as genuine deterrents, and penalties will likely continue to increase. This is the second CCPA enforcement action to address purpose limitation, following the AG's settlement with Healthline — and the first action enforcing the data minimization principle. That combination makes this case a template, not a one-off. If your company collects behavioral or location data through a connected product, and somewhere in a deal memo there's a line about "additional monetization opportunities" for that data, this is the settlement your legal team should already be reading.
No system was hacked, and no one set out to break a rule. A data deal went forward without customer consent for this specific use. General Motors is now paying $12.75 million, operating under a five-year sales restriction, and running a privacy program it didn't have before.