Why Location Data Changes the Stakes

For GM and OnStar, precise geolocation is not just another vehicle signal. It can turn a record of a driving event into a record of where a California consumer spends time, and the CCPA treats that difference as legally significant. This chapter explains the statutory category, traces how an event-linked coordinate can reveal a private destination, and distinguishes the CCPA’s sensitive-information control from the GM judgment’s case-specific consent and vehicle disablement requirements.

Precision is a legal category

The California Consumer Privacy Act defines precise geolocation as data derived from a device and used or intended to locate a consumer within an area equal to or smaller than a circle with a radius of 1,850 feet, subject to regulations. The statute lists precise geolocation among the categories of sensitive personal information. That classification matters because sensitive information receives a distinct control: a consumer may direct a business to limit its use and disclosure to the uses necessary to perform services or provide goods reasonably expected by an average consumer, along with other purposes identified by the statute and regulations.

The legal significance does not depend on whether the business calls the field “GPS,” “location,” “trip data,” or “vehicle telemetry.” The relevant questions are what the data can locate, how closely it can locate someone, whether it can be linked to a consumer, and what the business or recipient does with it. A location point stored with a vehicle identifier or account can remain personal information even if the system treats it as an ordinary event attribute.

Precision also changes the risk of combination. A single point may be ambiguous. A sequence of points can show a pattern. When the record includes the time of a hard-braking event, the location at which the vehicle stopped, and an account that identifies the consumer, the information can say more than “a braking event occurred.” It may reveal the place connected to the event and the person connected to the vehicle. The CCPA’s category and the CPPA’s guidance recognize that the consequence of processing depends on what the field can expose, not only on the field’s internal name.

This is why a business cannot answer the location question by showing that it needs some location data for some service. A navigation function may need a current location to calculate a route. An emergency response may need location to find a vehicle. Those facts may support a narrow use. They do not establish that a historical, consumer-linked location record should be retained indefinitely or sent to a recipient that has no need for its precision.

The inference happens between events

The complaint alleges that OnStar automatically collected GPS data during driving events such as speeding or hard braking. It further alleges that GM sent Lexis similar behavior data plus GPS information, including the location where the ignition was turned off. That combination is what the complaint characterizes as the sale of precise parking locations. The allegation is case-specific, and the underlying transfer records are not included in the source packet. But the mechanism it identifies is clear enough to analyze.

A driving event is a narrow description of what happened on the road. Its attached coordinate can add the where. If the vehicle is located when the ignition is turned off, the coordinate may indicate where the vehicle was parked. If the record is associated with an account, the location can be connected to a particular consumer.