A patchwork that now says the same thing
The multistate settlement with General Motors is the third enforcement action over the same product, OnStar's Smart Driver. According to reporting on the deal, a coalition of attorneys general led by Oregon and Washington will collect $220 million. They alleged that GM sold identifiable driving and location data to data brokers, who passed it to insurers. GM did not admit wrongdoing and says the agreement addresses a product it ended in 2024.
The terms are plain. GM must limit the driving data it collects and obtain express consent before collecting or sharing it. The consent judgment also adds dealer oversight and training, and it lets consumers request copies of their data and ask for deletion. It pays no restitution to individual drivers, a point Michigan's attorney general criticized, according to Top Class Actions.
The case for the enforcers
The strongest argument for these actions is about consent. The coalition alleges that the OnStar app told more than 370,000 drivers they were not enrolled in Smart Driver while data collection continued, per Top Class Actions. The same report says Oregon's complaint puts revenue from the data sales above $20 million. If those allegations hold, this was not a case of ambiguous disclosure. Drivers who thought they had opted out were still being profiled. A market cannot discipline a practice that buyers do not know exists. Drivers cannot shop for a car on its data practices when the dashboard misreports its own enrollment status.
That is a fair reading of the facts, and enforcement was warranted.
Three regulators, one template
What stands out is how closely the three actions agree. The FTC finalized its GM order on 14 January 2026. It bans disclosure of geolocation and driver behavior data to consumer reporting agencies for five years. It requires affirmative express consent before GM collects, uses or shares connected-vehicle data, and it runs for 20 years. The final Decision and Order also requires a way for consumers to request copies of their data and seek deletion. It lets them disable precise geolocation collection where the vehicle supports it.
California's May 2026 settlement carries $12.75 million in civil penalties. White & Case's analysis calls it the largest CCPA settlement to date. The California Attorney General's office described it as the state's first data-minimization enforcement action. Reporting on that deal adds a requirement to delete retained driving data within 180 days.
A state settlement now matches the federal order on its core terms. Consent comes first. Collection is limited to what the service needs. Data does not flow to the insurance-scoring industry. For other automakers, the practical result is a de facto national standard built without a single new statute.
Why this is the better route
The pro-innovation argument for this outcome is that it is narrow. Each action targets a specific, alleged deception: data was collected and sold under a feature that drivers did not understand or had declined. None of them restricts telematics itself. Connected-car data underpins crash notification, stolen-vehicle recovery, predictive maintenance and the training data that driver-assistance and autonomous systems depend on. Drivers can also choose usage-based insurance. The FTC's own response to commenters notes that GM-vehicle owners may still send driving data directly to their insurers through apps and devices, as the FTC's press release and order materials explain. A consent rule leaves that choice with the driver. A blanket ban on data use would not.
This also shows why enforcing existing consumer-protection law works better than writing vehicle-specific data rules in advance. The unfair-and-deceptive-practices theory reached conduct no telematics statute anticipated, and the remedies fit the harm.
What the baseline does not settle
Three gaps remain, and they matter more as vehicles become more autonomous.
- Purpose limits, not just consent. Consent screens are only as good as their design. The GM facts involve an app that allegedly misreported enrollment. Regulators should prefer data-minimization duties, such as California's deletion window, over longer notices that drivers click through.
- Autonomy data is different in kind. Sensor logs, in-cabin video and driving-environment recordings from autonomous systems are richer than the trip-level scoring data in Smart Driver. Nothing in these orders addresses them, and each carmaker will have to decide how its consent terms treat them.
- Compliance risk for smaller firms. GM can fund a privacy program and 20 years of FTC oversight. A start-up supplying telematics or fleet software cannot easily match that. A state-by-state patchwork, with Texas still pursuing its own case, as The Register reported, raises costs for exactly the entrants that challenge incumbents.
What Congress and the states should do
The consent-first baseline is sound, and it should be codified as a floor rather than reinvented in each state. A federal standard that preempts conflicting state rules would give automakers and developers one rulebook. It should require express consent for sale or disclosure of driving data to third parties. It should require retention limits and treat insurance use as a separate opt-in. It should leave in-vehicle safety and autonomy functions free of consent friction. Until then, the GM orders are the clearest guide to what regulators will treat as unlawful.
A $220 million figure grabs attention. The lasting effect is the template: every connected-car maker should assume regulators will apply these terms to them.