When Service Data Becomes a New Product
The GM/OnStar matter centers on a deceptively simple transition: information gathered to operate a connected-car service was allegedly sold into products designed to rate drivers for insurers. This chapter reconstructs that alleged chain and asks two different questions about it: was the later insurance-related purpose disclosed and compatible with the original service context, and was each field, especially precise location, reasonably necessary and proportionate? The distinction lets readers assess the case without treating a complaint’s allegations as adjudicated facts.
The alleged chain from service to broker
The chronology begins with the service relationship, not the data broker. The complaint alleges that GM began collecting names, contact information, and driving-behavior data from California consumers in 2016 through OnStar. It describes Smart Driver as an app-based, gamified feature that offered feedback about potentially unsafe habits, including hard acceleration and repeated rapid braking. In operating OnStar and Smart Driver, GM also allegedly collected precise geolocation for services such as emergency assistance after a crash and turn-by-turn directions.
These uses give the information an initial context. The data was not described as being collected first for an insurance score. It was connected to a service that a consumer used in a vehicle: assistance, navigation, or feedback. That does not prove that every later use was forbidden. It does mean a later purpose must be compared with the reason the record entered the system in the first place.
The complaint alleges that the relationship changed in 2020. GM allegedly began selling much of the OnStar and Smart Driver data to LexisNexis Risk Solutions and Verisk Analytics. The brokers, according to the complaint, used the information to develop driver-rating products for insurers. Those products were associated with usage-based insurance, in which driving behavior can be used to assess a driver. The complaint says GM made approximately $20 million nationwide in connection with the sales.
The downstream path was not identical for both recipients. The complaint alleges that Verisk paid GM for names and addresses together with behavior data such as speeding, rapid acceleration, and hard braking. It says the GM–Verisk contract expressly barred GM from providing precise geolocation and required that information to be stripped from transmitted driving data. Lexis allegedly received nearly the same behavior data but also received GPS information automatically collected during driving events. Because some events included the place where the ignition was turned off, the complaint characterizes the transfer as including precise locations where consumers parked their vehicles.
The complaint further alleges that Lexis did not use the precise geolocation for its driver ratings, even in states where driving behavior could be used for insurance purposes. That is a crucial allegation because it separates the utility of the product from the quantity of information transferred. If a recipient did not need a precise location to perform the claimed rating function, sending that location would be difficult to defend as a minimum-data choice. The source packet does not include the complete broker contracts or technical transfer records, so the allegation identifies a question for evidence rather than closing it by itself.
The California context adds another mismatch. The complaint alleges that usage-based insurance was illegal in California and that California insurers did not order reports about California drivers from the brokers, likely because state protections meant those reports had no lawful use. The qualifier matters. The record supports an allegation that the data had little or no practical lawful use for California insurance rating; it does not establish that no California consumer was affected by any downstream processing, or that no other use was possible.
The diagram is a reconstruction of the complaint’s alleged path, not a finding that every arrow occurred exactly as shown. Its point is to preserve distinctions that a broad label such as “sharing” would erase: the source of the data, the recipient, the fields transmitted, the proposed use, and the legal and practical setting in which that use would occur.
Two recipients can create two different privacy questions
It is tempting to analyze the alleged sales as one event: GM sent “driving data” to “insurance partners.” That description is too coarse. A lifecycle analysis follows the record at field level because a field can determine both the benefit of a transfer and its risk.
Consider a hard-braking event. A connected service may need the event to calculate feedback for a consumer. A broker building a driver-rating product may need a count or classification of braking events. Neither use necessarily requires a precise coordinate. A name or address may be relevant to linking a record to an account, but that does not automatically establish why a broker needs the exact location where the vehicle was parked. The usefulness of one field cannot be assumed from the usefulness of another field in the same record.
The alleged Verisk restriction makes this visible. The complaint says the contract barred precise geolocation, so the behavior data sent to that broker was allegedly stripped of that detail. The alleged Lexis transfer did not have the same boundary. Lexis allegedly received GPS information tied to driving events, including ignition-off locations, even though the complaint says the precise geolocation was not used for the rating product. The relevant comparison is not that one broker was “privacy friendly” and the other was “privacy hostile.” The evidence is too limited for that personality judgment. The narrower conclusion is that recipient-specific field restrictions can materially change a privacy analysis.
Recipient identity matters as well. A driver may understand that GM or OnStar needs a location signal to respond to a crash or provide directions. A data broker is a different party with a different commercial relationship. When the recipient changes, the business must explain why the new party needs the data, what the party may do with it, and how the consumer’s choices apply. A contractual restriction can reduce risk, but it does not replace the need to ask whether the disclosure itself was part of the disclosed and compatible purpose.
The alleged sales also show why hindsight must be used carefully. The complaint says the records were collected from 2016 and sold beginning in 2020. The later public controversy or legal action may make the transition look obvious in retrospect, but it does not tell us exactly what each employee, contract owner, privacy reviewer, or recipient knew at every earlier moment. A fair analysis asks what the service purpose, recipient arrangement, notice, and field requirements showed when the decision was made. It then asks what later evidence can establish about the actual implementation.
Purpose limitation asks “why this use?”
The CCPA’s central rule in Civil Code section 1798.100(c) says that a business’s collection, use, retention, and sharing must be reasonably necessary and proportionate to achieve the purposes for which the information was collected or processed, or another disclosed purpose compatible with the context in which it was collected. It also prohibits further processing in a manner incompatible with those purposes.
That rule creates a purpose question before it creates a data-volume question. What was the consumer-facing reason for collecting the information? What new purpose is the business proposing? Was the new purpose disclosed? Even if disclosed, is it compatible with the context in which the consumer provided the information?
The complaint’s theory is that consumers allowed GM to collect driving and location data to receive OnStar and Smart Driver services, not to set auto insurance rates. It alleges that GM never disclosed the insurance-related sales and that using the information to develop an unrelated driver-rating service was incompatible with the original connected-car context. The complaint invokes a regulatory example in which data collected to provide a requested cloud-storage service was later used to research an unrelated facial-recognition service, arguing that a similarly unrelated insurance-rating purpose could not be treated as compatible merely because both involve data processing.
That is the People’s legal theory, not a universal answer for every secondary use. A different connected-car service might disclose a particular analytics purpose at enrollment, use a recipient that performs a service on the business’s behalf, or obtain a separate consent for an unrelated feature. The relevant facts would change the analysis. The general lesson is narrower and more useful: a business cannot make the original service purpose disappear simply by retaining the record and later finding a buyer.
The California insurance setting strengthens the alleged incompatibility argument but does not replace it. If state law prevents insurers from using driving behavior to set rates, a business should ask why it is transferring the data for a rating product that may have no lawful practical use in that state. Yet even if insurers never ordered a California report, the privacy question would remain. The alleged disclosure could still be evaluated by asking whether it was disclosed, compatible, necessary, and proportionate. Lack of a downstream purchase is not the same as proof that the transfer never occurred or that the transfer was harmless.
Minimization asks “how much, for how long, and with what safeguards?”
Purpose limitation and minimization overlap, but they are not the same test. Purpose limitation asks whether the processing belongs to the context at all. Minimization asks whether the business is using, retaining, or sharing more information than that purpose requires.
The CPPA’s Enforcement Advisory No. 2024-01 explains the minimization analysis through three considerations: the minimum personal information necessary to achieve the identified purpose, the possible negative impacts of collecting or processing it, and additional safeguards that specifically address those impacts. The advisory says the analysis applies to each purpose for which information is collected, used, retained, or shared. It is official Enforcement Division guidance, but it expressly does not create substantive rights or a safe harbor; the statute and regulations control.
Applied to the alleged GM/OnStar chain, the first minimization question is field selection. Suppose the proposed purpose were to develop a driver-rating model. The business would need to identify what information that product actually requires. A behavior indicator may be relevant; a precise parking coordinate may not be. The complaint alleges that Lexis did not use precise geolocation for its ratings, which, if supported by underlying records, would be evidence that the location field was not necessary for that purpose. It would not automatically prove that the entire transfer was unlawful, but it would make the field-level question concrete.
The second question is impact. A precise location can disclose more than a driving event. Repeated locations can reveal where a person lives, receives care, worships, works, or participates in civic activity. The CCPA classifies precise geolocation as sensitive personal information, and the CPPA advisory uses health-care visits as an example of how location processing can reveal additional sensitive information. That risk changes the proportionality analysis even when the business sees the coordinate as just another column in a dataset.
The third question is safeguards. The alleged Verisk restriction—if accurately reflected in the contract and implementation—would be one kind of safeguard because it removes precise location from that transfer. Other safeguards might include using a coarser location, separating identifiers from event data, limiting retention, restricting recipient use, or deleting the field before disclosure. The source packet does not establish which of these methods GM used across the alleged Lexis path. It does establish why a privacy review should ask about them before a transfer begins.
Retention also belongs in minimization. A field that is necessary for a short-lived service response may not remain necessary for years. The complaint alleges that GM kept driving and location data long after it was needed for OnStar or Smart Driver, and that it sold data unnecessarily even though California law made the ostensible insurance use impractical. Those claims remain allegations, but they expose a common reasoning error: a justification for initial collection is not a permanent justification for storage or later disclosure.
What the record shows—and what would change the analysis
The strongest conclusion supported by the current record is not that every connected-car data sale violates the CCPA. It is that the alleged GM/OnStar path presents several distinct decision points that must be tested separately. The initial service context may support some collection. A later insurance-rating purpose may be different from that context. A recipient may need behavior data but not precise geolocation. A contract may restrict one transfer without governing another. A field may become unnecessary when a service ends. Each conclusion depends on the specific facts attached to that transition.
The source status matters. The complaint is a pleading by the People of California, based in part on information and belief. It alleges the chronology, the broker arrangements, the misleading statements, and the lack of practical California insurance use. The CCPA supplies binding statutory rules. The advisory explains a minimization framework but disclaims the status of a safe harbor. The stipulated judgment is an operative order with case-specific obligations, yet it says GM entered it without trial or adjudication of fact or law and without admitting liability. These authorities can illuminate one another without being treated as interchangeable proof.
Several kinds of evidence would sharpen or change the analysis: the notices actually shown to consumers, the consent and opt-out records, the complete GM–Lexis and GM–Verisk contracts, field-level transfer specifications, retention and deletion logs, and records showing how recipients used or did not use the data. Evidence that a precise location was necessary for a disclosed service purpose would answer one question but not necessarily the purpose-compatibility question for an insurance product. Evidence that a recipient never used a field would bear on utility and minimization but would not by itself resolve whether the transfer was disclosed or authorized.
The case therefore resists a single verdict such as “data sharing is bad” or “the consumer agreed at signup.” The more precise judgment is that a service record becomes a new product when its purpose, audience, or field requirements change, and that each change creates a new lifecycle test. The next step is to combine that test into a compact model: identify the actors and data, state the purpose, check compatibility and necessity, verify consumer control, and define what happens when the record is no longer needed.