On May 8, California Attorney General Rob Bonta announced a proposed $12.75 million settlement with a U.S.-based global automotive manufacturer (GAM) for alleged violations of the California Unfair Competition Law, False Advertising Law, and California Consumer Privacy Act of 2018 (CCPA). The enforcement action was filed jointly by the California Attorney General’s Office (AG) and the district attorneys of four California counties, with support from the California Privacy Protection Agency.
The enforcement action, imposing the largest fine to date under the CCPA, centers on GAM’s collection, retention, and sale of California residents’ driver-related data, including precise geolocation information originating from GAM’s connected vehicles and its in-car GPS service.
Business Practices at Issue
According to the complaint, from 2016 to 2024, GAM collected and retained driver and driving-related data from hundreds of thousands of Californians who subscribed to GAM’s in-car GPS and connected vehicle services. This data included names, phone numbers, home addresses, driving behavior (speeds, rapid acceleration, and hard braking), and the GPS locations of where subscribers drove and parked their vehicles.
In 2020, GAM began selling this information to two data brokers for the purpose of developing a driver rating product for auto insurers based on driving behavior.
The AG alleged that, in conducting this business practice, GAM violated CCPA obligations pertaining to the sale of personal information, the disclosure of sensitive personal information (i.e., precise geolocation), and principles of purpose limitation and data minimization. Specifically, the following practices gave rise to the enforcement action:
- Selling consumers’ personal information to third parties without disclosing such sales or offering consumers the ability to opt out of such sales.
- Using and disclosing consumers’ sensitive personal information without offering the required notices or the ability to limit such uses or disclosures.
- Using and/or sharing consumers’ personal information for an unexpected purpose.
- Retaining consumers’ personal information for longer than necessary to achieve the purpose of collecting and selling such personal information.
The latter two points reflect the principles of purpose limitation and data minimization, respectively.
Notably, this enforcement action is the first to address data minimization and indicates the direction California will take in investigating and implementing this compliance requirement. In this case, the data minimization requirement was not met because GAM retained personal information longer than necessary to provide its in-car GPS service. The AG further concluded that the sale of personal information to data brokers was unnecessary to provide the service, constituting an additional violation of the data minimization principle.
Key Privacy Compliance Takeaways
In addition to the multimillion-dollar fine, the proposed settlement imposes remedial actions that mirror existing CCPA obligations for businesses that sell personal information or process sensitive personal information. Key requirements include:
- Privacy notices. Ensure that privacy notices accurately disclose all business practices involving personal information. If the business exchanges personal information for monetary or other valuable consideration (a “sale”), it must disclose that practice in its consumer-facing privacy policy.
- Consent. Obtain separate consent before collecting, using, or disclosing personal information for purposes unrelated to those disclosed to consumers.
- Opt-out rights for sale of new consumers’ information. Provide consumers with the ability to opt out of the sale of their personal information if the sale was disclosed to consumers during onboarding.
- Opt-in rights for sale of existing consumers’ information. Abstain from selling personal information collected before the business disclosed such practice unless the business obtains consumers’ explicit opt-in.
- Limit use of sensitive personal information. Provide consumers with the ability to limit the use of their personal information (e.g., precise geolocation) when used for a purpose unrelated to the one for which the personal information was collected, unless there is a statutory exemption.
- Data processing agreements. Ensure data processing agreements between the business and third parties (not just service providers) contain proper prohibition of or consent to use sensitive personal information.
- Risk assessment. Conduct privacy risk assessments before engaging in the sale of personal information or the processing of sensitive personal information in a manner not exempted under the CCPA. The CCPA risk assessment requirements effective January 1, 2026 require a business to submit a summary of its privacy risk assessment report to the AG or the California Privacy Protection Agency.
Summary
The GAM enforcement action signals the direction California regulators will take in enforcing the CCPA. It reflects a coordinated approach among state regulators, a willingness to investigate multi-layered compliance failures, and a readiness to impose significant fines.
For businesses, this means that privacy compliance must extend beyond governance structures, policies, and procedures. They should ensure that privacy rights are factored into operational and strategic decisions involving personal information.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2026 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
