The nation’s largest CCPA penalty exposes how automakers turned your daily commute into a product.
By Jose E. Navarro | The Navarro Report
You buckled your seatbelt, merged onto the freeway, and headed to work. General Motors was watching — and selling what it saw.
In May 2026, California Attorney General Rob Bonta announced a landmark $12.75 million settlement with General Motors, the largest penalty ever secured under the California Consumer Privacy Act and the state’s first enforcement action centered on the CCPA’s data-minimization principle. The case reveals something essential and alarming: your car has become one of the most invasive surveillance tools in your daily life, and for years, automakers profited from that surveillance without your knowledge.
According to the California Department of Justice, GM collected names, contact information, precise geolocation data, and granular driving-behavior metrics from hundreds of thousands of California residents through its OnStar connected-vehicle platform. That data was then sold to LexisNexis and Verisk — data brokers whose clients include insurance companies. Californians were not adequately notified. They did not meaningfully consent. And GM retained and sold the data well beyond what was necessary to operate its own services.
The data-minimization principle — the legal requirement that companies collect only what they need and retain only what is necessary — sits at the heart of this case. It is a straightforward concept: if you do not need the data to deliver the service, you do not get to keep it, let alone sell it. GM violated that principle at scale, and California is the first state to hold a major automaker accountable for doing so.
The settlement requires GM to implement substantial reforms to its data practices, though the company has not publicly admitted wrongdoing. What the case does make undeniable is that connected-vehicle data has become a multi-billion-dollar commodity — one that consumers rarely know exists and almost never control.
With over 280 million registered vehicles in the United States and virtually every new model equipped with connectivity features, the GM settlement should be understood not as an endpoint but as a beginning. Automakers, insurers, and data brokers have constructed an ecosystem that monetizes your movement. California just placed a consequential marker in the sand. The question now is whether Congress and other states will follow.
For California drivers, the pragmatic takeaway is this: read your connected-services agreements, opt out of data-sharing programs where available, and understand that your vehicle may know more about you than your smartphone — and may be far less discreet about sharing it.
— Jose E. Navarro, The Navarro Report / Human-Directed AI Journalism: Research, analysis, and editorial direction by the author. Drafted in partnership with Claude AI (Anthropic).