On 8 May 2026 the California Attorney General announced a record privacy settlement: General Motors will pay $12.75 million and stop selling driving data to consumer reporting agencies, after collecting OnStar location and driving information from hundreds of thousands of Californians and selling it to data brokers. It is the largest CCPA penalty California has issued, and the part that should hold your attention isn't the fine — it's that this is the normal state of how modern cars handle the data you generate.
Here's what your connected car actually knows about you, where that data tends to go, and what you can practically do about it.
What a modern car collects
Modern vehicles aren't just transport; they are connected sensor platforms. A typical 2020s-or-newer car records and transmits a wide range of data, usually through a cellular link the manufacturer built in:
- Location and route history (GPS), including where you park and when you arrive.
- Speed, hard braking, acceleration, cornering, seatbelt use, mileage.
- Vehicle health: fuel or charge level, tyre pressure, battery voltage, fault codes.
- Crash data — both pre- and post-impact.
- Increasingly: driver-attention signals (head and eye position), heart rate, and from in-cabin cameras, who is in the car.
- Account and app data linked to your phone — contacts, message metadata, voice queries.
Different manufacturers collect different subsets, but the trend has been steadily in one direction: more sensors, more uplink, more data.
What "sold to brokers" actually means
The GM case is the cleanest illustration so far. From 2020 to 2024, GM collected driving data via OnStar — speeds, braking, sharp turns, mileage, location — and sold it to two well-known data brokers, Verisk Analytics and LexisNexis Risk Solutions. Verisk and LexisNexis package that into "driving behaviour" profiles and resell them to insurers. The driver is then rated, sometimes without their knowledge, on a profile derived from their own car.
GM reportedly made roughly $20 million nationally from these sales — small change for the company, large enough to be worth doing. California's complaint argued GM never told customers any of this, and worded its disclosures to imply OnStar data would only be used to deliver the services subscribers asked for.
Why this is a privacy story, not just a fine
Two things make this different from "company collects data, people grumble."
First, the data goes to brokers. Brokers exist to combine inputs no single source agreed to share with each other — your driving from one source, your address from another, your spending from a third. That combination is what turns "data" into a profile worth selling.
Second, the consequences are now financial, not theoretical. People discovered the practice when their car insurance went up, sometimes years after the trips that triggered it. There is no easy way to dispute a rating built from data you didn't know was being collected, because the chain runs car → manufacturer → broker → insurer, and each step shrugs at the next.
The legal turn — and its limits
The GM settlement is one of several signs that this is being taken seriously by regulators. California's $12.75 million fine is the largest CCPA penalty in the state's history. The order forces GM to stop selling driving data to consumer reporting agencies for five years, delete retained driving data within 180 days except for limited internal uses, ask Verisk and LexisNexis to delete what they bought, and stand up a real privacy program.
That's significant, and also narrow. It applies to GM, in California, for a specific class of data flow. Other manufacturers, and the rest of the data still being collected, are not covered.
Oregon's universal opt-out law for vehicle data went into effect in January 2026 — a separate state-level step in the same direction. Federal action is being discussed but, for now, not in force.
What you can actually do today
A few moves materially reduce what your car shares:
- Read your car's privacy settings. Most manufacturers now have an in-app or in-dash data and privacy section. Turn off anything along the lines of "data sharing for product improvement," "personalised offers," or "driving analytics."
- Cancel or limit connected services you don't use. OnStar, FordPass, Toyota's connected services, Tesla's data sharing — if you don't need the feature, the connection that collects the data doesn't need to be on.
- Use a regulator's opt-out where you have one. California, Oregon, and a growing list of states require companies to honour opt-outs of "sale" and "sharing." Send a Do-Not-Sell / Do-Not-Share request to your manufacturer; many now have a web form.
- Audit your insurance. If your rate has changed unexpectedly, ask whether driving data was a factor and from whom. You can request a free copy of your LexisNexis or Verisk consumer report and dispute incorrect entries.
None of this stops collection entirely. Mostly it stops collection-and-sale, which is the part that has been turned into money on the back of your habits.
The takeaway
The GM settlement isn't a one-off scandal; it's a snapshot of how connected cars have quietly become data businesses. The honest reading is that you are no longer just buying a car — you are also providing it with content, and the content is you. Regulators are starting to push back, state by state, but the change is uneven. The settings menus and opt-out requests aren't perfect and aren't fast, but they are real — and using them is the difference between a car that watches you and a car that mostly just drives.