General Motors (GM) agreed to pay $12.75m to resolve claims that it illegally sold hundreds of thousands of Californians’ location and driving data to two data brokers, said the state’s attorney general, Rob Bonta, on Friday. He said this came after the Detroit-based automaker had given “numerous statements reassuring drivers that it would not do so”.

“General Motors sold the data of California drivers without their knowledge or consent,” Bonta said in a statement. “This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians.”

The $12.75m settlement, which is subject to court approval, is for civil penalties. The state is also restricting GM’s use of consumer-driving data and instituting a five-year ban on such data being sold to any data broker.

Once the precise location of a vehicle is revealed, all sorts of sensitive information can be gleaned, including where people live, work, go to school or church. When that data makes its way into the data broker industry, it can be nearly impossible for consumers to control how it’s spread.

“Modern cars are rolling data-collection machines,” said Brooke Jenkins, San Francisco’s district attorney. “Californians must have confidence that they know what data is being collected, how it is being used and what their opt-out rights are. Those duties fall on the automobile companies.”

Carmakers have been increasingly scrutinized in recent years over their ability to access driver data and share it with insurance companies and data brokers. The New York Times investigated GM and other automakers in 2024, looking into how consumers’ driving behavior was shared with insurers. The news outlet found that some companies raised their rates based on this data.

California first started investigating GM and other car manufacturers in 2023. The inquiry was done in conjunction with several district attorneys across the state, including Jenkins, and the California privacy protection agency.

The lawmakers found that from 2020 to 2024, GM had sold the names, contact information, geolocation data and driving-behavior data of hundreds of thousands of Californians to the data brokers Verisk Analytics and LexisNexis Risk Solutions. The company collected the data through its OnStar technology, which is its in-vehicle security subscription service. GM reportedly made approximately $20m from these sales.

Bonta said California drivers would not see increased insurance premiums from GM’s sales because insurers were prohibited from using driving data to set their rates in the state. But Bonta added that GM misled consumers for saying in its privacy policy that it would not sell driving or location data, and then handed it over to data brokers anyway without consumers’ consent.

GM didn’t immediately return request for a comment.