California Just Hit GM With a $12.75M Privacy Fine. Here's Why.

Our Take

Credit to Verified Privacy VPN for laying out the receipts on this one: GM spent four years quietly funneling precise geolocation and driving behavior on hundreds of thousands of Californians to Verisk and LexisNexis, who repackaged it into a "risk score" sold back to insurers. California's $12.75 million penalty is the largest CCPA fine on record, but set against the roughly $20 billion GM reportedly pulled in nationwide from this kind of data arrangement, it reads less like punishment and more like a rounding error. The message corporations take from fines like this is simple: the fine is just the cost of doing business.

This case matters to us because it's the same playbook we track every day with license plate readers. Whether it's an automaker's telematics system or a Flock camera bolted to a stop sign, the underlying business model is identical — harvest location and movement data on ordinary people, then monetize it through a web of brokers, insurers, and law enforcement contracts that most drivers never consented to and can't see. GM at least needed a car with a cellular modem to track you. Flock just needs a street you drive down.

The difference is that GM's data grab required some digital infrastructure most people can at least theoretically opt out of. ALPR networks don't ask. They log every plate that passes, retain it, and share it across jurisdictions and private databases with far less oversight than California's privacy law could ever muster. If a $12.75 million fine barely dents a company that made $20 billion off driver data, imagine how little accountability exists for a surveillance network that was never designed with consumer-protection guardrails in the first place. Check our camera map to see what's logging your plate, and visit take-action for ways to push back.