On 8 May 2026 the California Attorney General announced a $12.75 million civil penalty against General Motors and OnStar, the largest CCPA penalty to date and, in the Attorney General's words, the Department of Justice's first action enforcing the data minimization principle. The conduct was a data flow, not a breach: from 2020 to 2024, according to the Attorney General, GM sold the names, contact information, geolocation data and driving behavior data of hundreds of thousands of Californians to two data brokers.
This is not an automated decisionmaking technology (ADMT) case, and the regulator did not treat it as one. It matters to anyone building toward 1 January 2027 anyway, because the brokers wanted that data to feed a driver-rating product for insurers, and insurance underwriting is exactly the kind of decision the ADMT rules exist for. If your product collects data that someone else turns into a score, the settlement is the clearest public example of what a regulator expects you to have built.
This is a builder's read of the public record, not legal advice. Counsel decides what applies to you.
What did California actually find?
The Attorney General's 8 May 2026 release says GM sold driving and location data from its OnStar service to Verisk Analytics and LexisNexis Risk Solutions, and that the brokers planned a driver-rating product that could be marketed to auto insurers for setting rates. The release says some insurers had raised consumers' rates based on this data, that California drivers were not subject to those increases, unlike drivers in other states, and that GM reportedly made approximately $20 million nationwide from the sales. It calls the settlement the eighth enforcement action under the CCPA.
The legal hook is Civil Code section 1798.100(c): a business's collection, use, retention and sharing of personal information must be reasonably necessary and proportionate to the purpose it was collected for. The regulation that fills that in is section 7002 of the CCPA regulations (Title 11, effective 1 January 2026). Read it as an engineer and it asks three things of every field you store.
What does section 7002 ask of each field you collect?
First, a purpose that matches what the person would expect. Section 7002(b) says the expectation turns on the relationship with the business, the type and amount of data, the source, how clearly the purpose was disclosed, and whether a service provider or third party's involvement is apparent. Its own example: the user of a flashlight app would not expect the app to collect geolocation to run the flashlight.
Second, a limit on how much. Section 7002(d) tests the minimum personal information needed for the purpose, the possible negative impact on the person, and the safeguards you put against that impact. Its examples of safeguards are encryption and automatic deletion within a set window.
Third, consent for anything else. Under section 7002(e), a purpose that does not meet the necessary-and-proportionate test needs consent, and the person has to be able to withdraw it at any time. Section 7002(f) adds that you cannot collect categories you did not disclose in the notice at collection, and a new incompatible purpose needs a new notice.
Notice what is missing: nothing in section 7002 says "unless the buyer pays well." A downstream sale is a new purpose, and the burden is on you to show it fits what the driver expected when the car was enrolled.
What did the court judgment make GM build?
The Attorney General posted the final judgment and permanent injunction (People v. General Motors LLC and OnStar, LLC, Napa County Superior Court, Case No. 26CV001011). These terms bind GM, not you, but they are a regulator's own list of controls. Read the paragraphs as a spec:
- Consent per feature (paragraph 25). GM must get consent before collecting, using or disclosing covered driving data, and each separate, unrelated service or feature that does so needs its own consent. The exceptions are narrow: emergency responders, responding to a message the driver initiated, safe operation, legal claims, safety investigations, and research that uses only deidentified data and excludes marketing.
- A switch that works (paragraphs 28 and 29). California customers can disable precise geolocation collection, and can stop remote collection of all data by declining or leaving the service, with named carve-outs.
- Deletion with a clock (paragraph 26). Previously retained driving data is deleted or destroyed within 180 days of the effective date, unless it falls under a listed purpose or the customer gave consent, with a written confirmation to the Attorney General.
- Deletion that reaches the recipient (paragraph 27). GM may not sell or disclose data to a third party it previously sold driving data to until that party confirms receipt of an instruction to delete what it got from GM.
- A five-year stop on one kind of buyer (paragraph 30). No sale or disclosure of covered driving data to a consumer reporting agency for five years without consent.
- A written assessment before the next change (paragraphs 32 to 34). GM must document an assessment of its geolocation use and its disclosures to third parties against section 1798.100(c) and section 7002, keep it five years, and update it before a material change in disclosure, or within 45 days if the change has already begun.
That last pair of numbers is the same rhythm as the general risk assessment rules. Section 7155(a)(3) of the regulations gives a business 45 calendar days to update an assessment after a material change, and section 7155(c) requires keeping assessments for five years. If you have read what goes into a CCPA risk assessment and the 45-day update rule, the judgment is the same machinery applied after the fact, by order.
Where does ADMT come into it?
Two places, and neither is in the GM judgment.
The first is the buyer. Insurance underwriting or terms is one of the five significant decision categories in section 7001(ddd). A broker's driver rating that an insurer uses to set a premium sits squarely in that category, so the insurer carries the ADMT obligations on 1 January 2027, including the pre-use notice, the opt-out or appeal route and access. An insurer that cannot say where the score's inputs came from has a hard time writing the access response. Building the access response starts with that question.
The second is you, the seller or the vendor. Section 7150(b)(6) makes processing personal information that you intend to use to train an ADMT for a significant decision a trigger for a risk assessment, and the text says "intends to use" includes permitting others to use it. Data you collected for one purpose and let a partner train a scorer on is inside that sentence. The regulation names the thing the GM brokers were doing.
A worked example: a scheduling product and a staffing marketplace
Picture a 40-person SaaS company that sells shift-scheduling software to warehouse employers. The mobile app collects a worker's device location at clock-in so the employer can confirm the worker is on site. Two years later a staffing marketplace offers to buy an anonymized-looking feed of clock-in times and locations, to build a reliability score it will use to rank workers for placements.
Run section 7002 on it. The purpose at collection was confirming presence at work. A worker using the app expects that, and expects the employer to see it. They do not expect a third party to rank them for jobs, and the marketplace's involvement is not apparent to them. That is an incompatible new purpose, so it needs consent that can be withdrawn, or it does not ship. Run section 7150(b)(6) on the marketplace side: if the score decides who gets placed, that is employment opportunities, a significant decision, and the data is training an ADMT for it.
Now ask what you would have to show. A table of every location field, its purpose, its retention period, and every recipient. A consent record that is tied to the feature, not to the account. A way to send the recipient a deletion instruction and keep the confirmation. An assessment dated before the feed started. A team with that table should be able to answer a regulator's first letter quickly. A team without it spends weeks reconstructing what it sold.
The practical exposure of skipping this is that the work lands in the wrong order. The assessment, the consent gate and the recipient deletion path are cheap to build before the first data sale and expensive after, because the data is already in someone else's warehouse. In GM's case the court had to order the company to ask its brokers to delete, then wait for their confirmation before selling to them again. That is a much slower way to run a deletion than a field in your own data model that tracks who received what.
It also lands before 1 January 2027 for anyone whose data ends up in a score. A buyer's counsel preparing an ADMT access process will ask their data suppliers for provenance, and a supplier with a purpose register has an answer.
When this is more than you need
If your product collects only what it needs to run, sends nothing to brokers or partners, and no one downstream scores people with it, you do not need a program. You need the purpose written down next to each field, counsel's sign-off, and a retention period you actually enforce. That is a spreadsheet and an hour, not an engagement. The weight starts when data leaves your system, or when a partner will use it to rank, price or screen people.
If you are in the second group, start with the free ADMT checker to see whether the buyer's use counts, read what counts as ADMT for the definitions, and look at vendor contract terms before you sign the next data deal. If you want engineering help building the purpose register, consent gate, deletion path and decision log, our ADMT compliance engineering service covers exactly that, and you can tell us what you ship and we will say honestly whether it fits.
Sources
- California Attorney General: Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement (8 May 2026)
- California Attorney General: Final Judgment and Permanent Injunction, People v. General Motors LLC and OnStar, LLC, Napa County Superior Court, Case No. 26CV001011, paragraphs 25 to 34
- California Privacy Protection Agency: CCPA regulations, Title 11 Division 6 Chapter 1, effective 1 January 2026, sections 7002, 7001(ddd), 7150(b)(6), 7155
