Overview

For GM and OnStar, retention is an affirmative privacy decision: the CCPA ties duration to a disclosed purpose and generally requires deletion from business records plus notice to relevant recipients after a verifiable request. The judgment adds case-specific deadlines for prior-retained covered driving data, recipient instructions, and exceptions for litigation, safety, diagnostics, research, cybersecurity, and warranty functions. Those requirements do not create a universal 180-day rule.

Learning outcomes

A retention period must remain tied to the disclosed purpose, not to storage capacity.
A deletion request can require coordination across the business, service providers, contractors, and prior third parties.
The GM judgment’s 180-day cleanup and recipient confirmations apply to covered GM data, not all historic vehicle telemetry.

Keywords

GM/OnStarCCPARetentionDeletionVerificationDeidentification

Retention Is a Decision, Not a Storage Setting

For GM and OnStar, the privacy question does not end when a vehicle transmits a driving event or a location point. It continues for as long as the record remains available to the business or a downstream recipient. This chapter connects the CCPA’s retention, deletion, and request-processing rules to the judgment’s cleanup requirements, so readers can decide when a record’s original value has expired, how deletion should travel, and when a bounded exception can justify keeping data.

Retention has to answer a purpose question

The CCPA requires a business that controls collection to tell consumers how long it intends to retain each category of personal information, or, when that is not possible, the criteria it will use to determine the period. It also says a business may not retain personal information for a disclosed purpose longer than is reasonably necessary for that purpose. The rule treats time as part of the privacy decision. Retention is not neutral simply because the information sits in a database rather than moving across a network.

For a connected-car service, the purpose may be time-sensitive. A precise location can be necessary while OnStar responds to an emergency or provides a requested direction. A driving event may be useful while Smart Driver calculates and displays feedback. But those functions do not automatically explain why every historical coordinate or event record should remain linked to a consumer after the response or feedback has been delivered. The business must identify what the record still does and why the amount of detail and the remaining duration are proportionate.

The complaint alleges that GM kept driving and location data for years beyond the needs of OnStar and Smart Driver. That is a pleaded allegation, not an adjudicated finding. It nevertheless illustrates the problem with treating a retention schedule as an administrative setting detached from purpose. If a business cannot say which current service requires a record, the justification for keeping it may have changed even if the original collection was defensible.

Time also changes exposure. A location record that was needed for a short response can later be combined with more records, accessed by more people, sent to a new recipient, or used for an unforeseen purpose. The California Privacy Protection Agency’s Enforcement Advisory No. 2024-01 describes minimization through the minimum information needed, possible negative impacts, and safeguards. Automatic deletion within a defined window is one safeguard the advisory gives as an example. The point is not that a single period fits every system. It is that the business should choose a period in light of purpose and risk rather than inherit indefinite availability from storage capacity.

The same principle applies to information collected while handling a consumer request. The CCPA requires a business to respond to a verifiable request within the statutory period, generally 45 days, with a possible extension when reasonably necessary and properly noticed. Information collected to verify the request must be used for verification and not retained longer than necessary for that purpose. The CPPA advisory warns businesses not to demand excessive personal information when processing opt-out or deletion requests. Verification is another purpose-specific processing activity, not a license to create a new identity database.

Deletion is a chain, not a button

A consumer’s deletion request makes the lifecycle visible. Under the CCPA, a business that receives a verifiable request generally must delete the consumer’s personal information from its records.

Published by DeepMox

FAQ

How long can a connected-car business keep vehicle data?

Under the CCPA, a business may not retain personal information for a disclosed purpose longer than reasonably necessary and must disclose the intended period or criteria when required.

Does deleting data from one database complete a deletion request?

No; deletion generally must account for relevant internal copies and notifications to service providers, contractors, and third parties that received the information, subject to exceptions.

Is GM’s 180-day vehicle-data cleanup a general rule?

No; the 180-day requirement is a case-specific judgment obligation for GM’s prior-retained covered driving data and its stated exceptions. It is not a universal deadline.

Previous10 minGM/OnStar Precise Geolocation

Next12 minGM/OnStar Privacy Governance

GM/OnStar Retention and Deletion

Retention Is a Decision, Not a Storage Setting

Retention has to answer a purpose question

Deletion is a chain, not a button

FAQ