General Motors has agreed to pay $12.75 million to settle a two-year investigation by California Attorney General Rob Bonta over the sale of customer driving data. The probe found that GM shared names, contact details, geolocation, and driving behavior of hundreds of thousands of drivers with data brokers like Verisk Analytics and LexisNexis Risk Solutions. California authorities emphasized that precise car location data reveals deeply personal patterns, including home, work, school, and religious sites.

Although insurers were initially suspected of using this data to adjust rates, California law prohibits such use, so drivers weren’t directly financially impacted. Still, the settlement marks a significant enforcement action on auto industry data practices. GM earned about $20 million from the data sales, meaning it still netted a profit after the penalty.

As part of the agreement, GM must stop selling driving data to consumer reporting agencies for five years, delete existing data within 180 days unless drivers explicitly permit retention, and implement a new privacy program to assess data risks and prevent future breaches. The case highlights growing scrutiny of how automakers handle the vast amount of personal data collected through connected vehicles.