California Privacy Enforcement Cases

Why the action was brought

GM allegedly unlawfully sold California drivers’ driving and precise location data collected through OnStar to two data brokers for driver-rating products, without disclosing those sales and while misleading consumers about data use. The conduct violated the CCPA’s purpose limitation and data minimization provisions; using driving data to set insurance premiums is illegal in California.

Why the action was brought

Datamasters failed to register as a data broker in 2024, violating California’s Delete Act, while buying and reselling names, addresses, phone numbers, and email addresses of millions of people with Alzheimer’s disease, drug addiction, bladder incontinence, and other health conditions. It also sold lists based on age, perceived race, political views, purchases, and banking activity for targeted advertising.

Why the action was brought

Premera’s 2014 breach exposed names, Social Security numbers, bank account information, medical information, and health claims-related data of 10.5 million consumers, including 400,000 Californians. Attackers used targeted emails and malware, while Premera lacked basic security, failed to monitor its network, ignored warnings, and allowed unnecessary employee access.