A view from DC: The one-two punch is a knockout for driver privacy

It was more than two years ago that the Texas Office of the Attorney General became the first enforcement body to make public moves against General Motors and its OnStar subsidiary, alleging privacy misconduct related to the company's collection and sharing of driver data. This week, we found out what other state enforcers have been up to, with the announcement of a major bipartisan multistate settlement with the company — to the tune of USD220 million — stemming from the same set of facts. Washington and Oregon led the action, joined by 33 other states and the District of Columbia.

Coming as it does after GM settled investigations from the U.S. Federal Trade Commission and the California Office of the Attorney General, this new coordinated action cements the company's history-making run, making it the first major data protection matter of the state privacy era. In combination, the settlements illustrate just how complex the terrain becomes as states deploy what I've called their one-two punch of privacy and consumer protection authorities.

The fines are only the tip of the remedial spear in these actions, even as they have grown to represent more than 11 times the USD20 million the company allegedly made from the practices in question. The 20-year injunctive terms include data deletion, executive sign-off and independent third-party assessment.

'People bought a car, not a tracking device'

The facts alleged in the multistate settlement paint the most complete picture yet about GM's driver data program. Beginning with the launch of its OnStar Smart Driver product in 2015, GM began measuring harsh braking incidents, aggressive acceleration events, time-of-day data and seat-belt compliance, plus, by 2018, precise geolocation pings every three seconds from ignition-on to ignition-off. 

In the dealership showroom, the onboarding pipeline was allegedly greased by programs that rewarded sales personnel with incentive payments for enrollment, resulting in dealership staff speeding through consent disclosures on behalf of buyers. Even for consumers who did consent, the system was allegedly not described in sufficient detail, packaged instead with the allure of anonymized insurance discounts. 

Behind the dashboard, the company tied telemetry data directly to individual Vehicle Identification Numbers, sharing it with Verisk and LexisNexis to build into insights products. The resulting risk scores were allegedly sold to insurance companies, causing consumers' insurance rates to change. Additionally, through secondary pipelines like the Wejo traffic-analytics stream launched in 2018, GM allegedly brokered vehicle location data flows across a network of "egress licensees" without informing consumers. 

Even where vehicle owners affirmatively attempted to verify or police their status, the governance mechanisms were sometimes hollow. An internal system glitch, which is alleged in detail for the first time in these new complaints, left more than 370,000 drivers enrolled in the data sharing system, even when it appeared to the consumer they were not enrolled. In the spring of 2024, after Kashmir Hill's investigative report for The New York Times first revealed these consumers were being monitored, the complaints describe how GM quietly scrubbed thousands of enrollees from the service without alerting them to the historical compromise.

In a press release, Oregon Attorney General Dan Rayfield put it this way: "GM told drivers this program would help them drive more safely and promised it wouldn't share their data with insurers without permission. Our investigation found GM sold that data anyway, and some drivers paid for it with higher premiums. This settlement puts people back in control of their own information."

The enforcer melee

We now know just how extensive a litany of state and federal inquiries GM has weathered over the past 30 months. Though Texas was the first to show its work, it was not the first state to see results. California took that prize, extracting USD12.75 million in financial penalties plus an injunctive program with a five-year clock. This is still the largest payout for any state but now seems proportionally small when compared to the payouts to the states on the executive committee of the multistate action, which in addition to Washington and Oregon as co-leads, includes Colorado, Connecticut, Delaware, Illinois, Kentucky, Maryland, Minnesota, New Jersey, Utah and Vermont.

However, the first enforcer past the post was the FTC, which finalized its settlement with GM in January 2026 after first announcing an initial draft one year earlier, at the very end of the agency's prior leadership. Though it lacks the authority to impose fines for this type of first-instance violation — setting aside consumer restitution, which on the alleged facts could have theoretically been possible but has not been part of any settlement to date — the FTC's settlement appears to form the foundation on which other states built their injunctive terms.

The FTC order includes:

• A five-year ban on selling driver data to consumer reporting agencies, stricter than the multistate, which will allow for this with affirmative express consent, after the FTC's ban expires, and only once the CRAs have confirmed deletion of prior data.
• Deletion of all prior collected driver data, including algorithmically derived data, unless specific consent overrides it, and confirmation of instructions to third-parties to also delete the data. 
• Access and deletion rights for consumers across the country.
• Sworn compliance reports to the FTC with a 20-year recordkeeping requirement, plus routine monitoring and oversight by the agency.

California's settlement is unique in its focus on the black-letter requirements of the California Consumer Privacy Act, notably including data minimization requirements, rather than broader consumer protection terms. This might have something to do with the fact that usage-based insurance is illegal in California, so California insurers didn't use the driver-rating product and Californians were spared any premium increases allegedly seen in other states. 

The violation is the secret sale itself, not the rate harm, plus a distinct allegation that selling data that could be used to set premiums facilitated a violation of California insurance law. The remedial measures largely track existing compliance requirements, with the added rule for annual reports to both the California attorney general and California Privacy Protection Agency, served with the knowledge of the company's CEO and general counsel. 

The new multistate settlements build on both prior orders in interesting ways, matching the FTC's 20-year term, while building more prescriptive remediation into the terms:

• A documented comprehensive privacy program within 180 days.
• A qualified chief privacy officer empowered with necessary resources, reporting at least annually to the CEO and the board or a board committee, plus at least quarterly to the general counsel.
• Documented data protection assessments before any new high-risk processing activity. 
• An inventory of OnStar covered driver data disclosures. 
• Annual general training for employees plus specialized training for program staff. 
• Service-provider and third-party due diligence, written contracts and governance processes to identify materially inconsistent use and corroborate self-assessments. 
• And biennial independent third-party privacy assessments to be provided to the Washington attorney general, who will serve as a reporting hub for the other states.

Consent nerds should also review the multistate settlements' bespoke "Affirmative Express Consent" requirements. The FTC order requires such consent for each separate service or feature with disclosures separate from a privacy policy, but the multistate builds more detailed structures around this. The details go farther even than state privacy law opt-in consent requirements, including terms related to dark-patterns, pre-ticked-boxes, affirmative actions by the consumer and treating silence as a declination after 10 days, plus separate disclosures for any usage-based insurance rate setting, as well as a hyperlink to a regularly updated page naming third parties. 

There are also interesting differences in the claims brought across the leading states in the multistate settlement based on whether or not their respective consumer privacy laws were in effect. Connecticut, for example, was in effect for a period of months while the alleged data sales continued. Accordingly, the state's complaint adds multiple Connecticut Data Privacy Act violations to the baseline consumer protection violation terms across the other states. 

These include compliance shortcomings related to: a meaningful privacy notice linking Smart Driver data to purposes and recipients; data minimization and purpose specification/limitation; affirmative consent for purposes beyond the notice, including selling driver history and precise geolocation to brokers; opt-out from sale; collecting, processing and selling sensitive data, specifically precise geolocation, without affirmative consent; and a compliant correction mechanism.

Back at the ranch

Meanwhile, in Texas, things have not been going well for the state in its ongoing litigation against GM. In early summer 2025, the Texas attorney general's office filed an amended petition in the case, markedly expanding the inquiry to include allegations well outside the scope of the original investigation.

In response, GM sought to block the lawsuit under the terms of its 2009 bankruptcy proceeding, which serves as a backstop to any liability for harms before that date. The relevant court agreed with GM's argument and blocked the Texas case in its current form saying "New GM" was "born innocent." 

The Texas attorney general could continue its litigation if it amends its complaint to return to New GM's alleged privacy missteps. In fact, other states are continuing down that same litigation path on their own. Copycat lawsuits in Arkansas, Indiana, Iowa, Montana and Nebraska may still be ongoing in various stages. Thus, even with the nationwide privacy program from the FTC and the new major settlement, GM's driver privacy story is not quite over.

Please send feedback, updates and driver data to cobun@iapp.org.