A $12.75 million CCPA settlement against General Motors, reported by Security Boulevard on July 22, 2026, marks the largest penalty yet under California’s privacy law and puts the connected-car data pipeline squarely in regulators’ crosshairs. OnStar has long sat at the center of scrutiny over how automakers collect granular driving-behavior data — speed, braking, location, mileage — and route it to third parties, including insurers and data brokers, often through consent flows critics say were buried or confusing.
For the data industry, the number matters less than the precedent. CCPA enforcement to date has largely produced settlements in the low millions or public reprimands; a figure north of $12 million signals that the California Privacy Protection Agency, or whichever enforcement body is cited by Security Boulevard, is willing to treat automotive telematics as a priority category rather than a peripheral one.
Connected-car data has quietly become one of the richest, least-scrutinized data streams in the consumer economy — until now.
Why this travels beyond Detroit
OnStar is a bellwether, not an outlier. Every automaker running a telematics program, every insurer buying driving-score feeds, and every data broker reselling location or behavioral exhaust from vehicles should read this fine as a floor, not a ceiling. Consent language that satisfies a marketing team rarely satisfies a regulator parsing CCPA’s notice-and-opt-out requirements, and this case suggests enforcement will keep testing that gap.
Expect ripple effects in contract negotiations between automakers and the insurance-telematics vendors that buy their data, with indemnification clauses and audit rights likely to get more attention. Boards overseeing data monetization units should treat this as the moment to re-price legal risk into any deal built on driver behavior data.
Watch for whether other state attorneys general or the CPPA follow with parallel actions against other automakers, and whether GM discloses changes to OnStar’s data-sharing practices as part of the settlement terms.
GM's Record $12.75 Million CCPA Fine: The OnStar Data Lesson
