GM’s Three Settlements Show Why Privacy Laws Make Consumer Protection Enforcement Hit Harder

When General Motors agreed on October 29, 2026 to pay $220 million to 36 state attorneys general, most of the coverage, including our own news report on the settlement, focused on the money and the new consent terms. The more durable lesson is about legal machinery. The GM matter has now been resolved, in separate actions, under three different kinds of law: a federal unfair-and-deceptive-practices statute, a state comprehensive privacy law paired with a state unfair competition law, and the old consumer protection statutes of dozens of states. Each covered a gap the others left open.

That combination is the real story for privacy and legal teams. Comprehensive privacy laws were sometimes described, when states first passed them, as a replacement for case-by-case consumer protection enforcement. The GM record shows the opposite. The privacy statute sets the rule, and the consumer protection statute gives enforcers reach, remedies and a theory that works even for conduct that happened before the privacy law existed. Together they hit harder than either does alone.

Three resolutions, one data flow

The underlying facts are consistent across all three matters. From 2016 to 2024, GM enrolled millions of drivers in Smart Driver, a feature of its OnStar connected-vehicle services that recorded how many times a person drove, when trips began and ended, how often the driver braked or accelerated hard and whether they exceeded the speed limit. Regulators allege GM sold that data to data brokers under contracts that specified insurance uses, and the brokers sold it on to insurers, some of which used it in setting premiums. GM ended Smart Driver in 2024 after The New York Times reported on the practice.

Here is how each enforcer approached it.

• The Federal Trade Commission finalized its order against GM and OnStar on January 14, 2026, a year after announcing a proposed settlement. The FTC alleged a misleading enrollment process and inadequate disclosure. The order bars GM for five years from disclosing geolocation and driver behavior data to consumer reporting agencies and, for the order’s 20-year life, requires affirmative express consent before collecting, using or sharing connected-vehicle data (with exceptions such as emergency responders) and requires ways for consumers to get a copy of their data, delete it and switch off precise location collection. We covered the order and the Texas activity around it in our report on the FTC’s final GM settlement.
• California announced a $12.75 million settlement in May 2026, brought by the attorney general and four district attorneys with support from the California Privacy Protection Agency. The complaint relied on both the California Consumer Privacy Act and the Unfair Competition Law. The attorney general called it the largest CCPA penalty to that date and the state’s first action enforcing the CCPA’s data minimization principle.
• The 36-state coalition, led by Oregon and Washington, settled for $220 million. Oregon, as its announcement explains, brought its case under its Unlawful Trade Practices Act, not the Oregon Consumer Privacy Act, because much of GM’s conduct predated the privacy law’s July 2024 effective date.

All three are settlements of allegations. None is a court finding that GM broke the law, and GM itself announced in April 2024 that it was discontinuing Smart Driver.

Why a deception claim needs a privacy statute behind it

Consumer protection statutes are broad by design. Most state laws, often called UDAP statutes, prohibit unfair or deceptive acts in trade, and the FTC Act does the same at the federal level. Their strength is flexibility. Their weakness, in privacy cases, is that the cleanest claim depends on what the company said.

The GM facts fit the deception model well because GM made promises. According to the state releases, GM pitched Smart Driver as a safety tool and told drivers it would not share their data with insurers without express consent. California said GM’s privacy policy stated it did not sell driving or location data. When a company says one thing and does another, a deception claim almost writes itself.

Now consider a hypothetical company that never made such a promise. Its privacy policy says, in general terms, that it may share data with partners for business purposes. It sells precise location data anyway. A deception theory is harder there because the company did not say anything false. An unfairness theory is available in many states, but unfairness requires showing substantial injury that consumers could not reasonably avoid and that is not outweighed by benefits. That is a fact-heavy argument, and defendants contest it.

A comprehensive privacy statute removes much of that argument. It does not ask whether the company lied. It asks whether the company met a rule. Oregon’s privacy law, as the attorney general noted, now bans the sale of Oregon consumers’ precise geolocation data by all covered entities, not just GM. California’s law imposes purpose limitation and data minimization, which is how California could challenge GM’s retention of driving data long after OnStar needed it and its later sale of that retained data. Neither claim depends on a misleading statement.

Why a privacy statute needs a consumer protection law behind it

The relationship runs both ways. Comprehensive privacy laws have limits that consumer protection laws do not share.

The first is time. A privacy statute generally applies only from its effective date, and many state laws took effect in 2023, 2024 or 2025. Conduct that ran from 2016 to 2024, like Smart Driver, falls largely outside them. Oregon said exactly this: the UTPA “remains a powerful tool for addressing privacy harms” and is complementary to newer privacy laws. Minnesota made a related point in its own release, noting that GM ended Smart Driver before the Minnesota Consumer Data Privacy Act took effect but remains subject to it going forward.

The second is coverage. Many of the 36 states in the coalition have comprehensive privacy laws, but not all of them do. A consumer protection statute gives every attorney general the authority to join a multistate action regardless of whether their legislature has passed a privacy bill, which is how a coalition that large can form around a single data flow.

The third is remedies and familiarity. Consumer protection statutes come with decades of case law on penalties, injunctions and settlements. Courts know how to apply them. California’s choice to plead both the CCPA and the Unfair Competition Law in its GM complaint, and again in its October 2026 case against Lyft, reflects that logic. For more on how the UCL operates in privacy disputes, see our explainer on unfair competition law claims in privacy litigation.

The one-two punch, in four parts

Taken together, the GM matters show four specific ways the two bodies of law reinforce each other. Each one changes how a company should assess its own exposure.

1. The privacy law defines the standard; the UDAP law enforces broken promises about it. Once a statute says precise geolocation is sensitive and requires consent, any privacy notice that implies the company meets that standard becomes a representation regulators can test. A gap between the notice and the practice is both a statutory violation and a potential deception.
2. Consumer protection law reaches back; privacy law governs forward. Regulators can use UDAP claims for historical conduct and privacy-law terms for what the company must do next. The GM settlements pair penalties for past sales with forward-looking consent, minimization and assessment obligations.
3. Privacy-law concepts are shaping UDAP remedies. The multistate settlement requires affirmative express consent, limits on the driving data GM collects, a comprehensive privacy program and internal and external assessments. Those are privacy-law ideas imposed through a consumer protection settlement, including in states that have no comprehensive privacy law.
4. Different enforcers can pursue the same data flow. The FTC, California and the coalition each extracted separate terms. Texas sued GM separately and, in January 2025, used its Texas Data Privacy and Security Act against Allstate and its subsidiary Arity over driving data collected through mobile apps, describing it as the first state attorney general action under a comprehensive privacy law. Our analysis of the Allstate and Arity suit covers that case, which remains in litigation.

What this means for companies outside the auto industry

The GM pattern applies to any business that collects data through a product and finds a buyer for it. Telematics is the obvious example, but the same structure exists in fitness wearables, smart home devices, mobile apps with location SDKs and loyalty programs. The enforcement question is no longer only “which privacy law applies to us?” It is also “what have we told people, and is it true?”

That shifts some practical priorities.

• Read your own marketing as an enforcer would. Product pages, onboarding screens and app store descriptions are representations. If they describe a feature as a safety or convenience tool and the data also feeds a revenue line, the gap is the risk.
• Treat precise location and behavioral telemetry as sensitive by default. Most state privacy laws already classify precise geolocation as sensitive data, and regulators have made it a priority. Our overview of sensitive data enforcement tracks the trend.
• Apply minimization to old data, not just new collection. California’s GM theory turned on retained data that was later sold for a new purpose. Data held “because we might use it” is exactly what minimization rules target. See our guide to data minimization under the CPRA and GDPR.
• Audit the channel that captures consent. Most Smart Driver enrollments happened at dealerships, where, according to Oregon, staff sometimes accepted terms for customers and were paid bonuses tied to enrollment. If a partner controls the consent moment, the partner’s incentives are part of your compliance posture.
• Do not rely on the absence of a privacy law in a state. Several coalition states have no comprehensive privacy statute. Their attorneys general joined anyway.

Where Captain Compliance fits

The common thread in these cases is a mismatch between what a company said, what it collected and where the data went. Captain Compliance’s data mapping and assessment tools are designed to document those three things in one place: the systems that collect personal data, the purposes recorded for each activity and the vendors and recipients that receive it. That record is useful precisely because it can be compared with the privacy notice and with consent records. No tool settles whether a disclosure is lawful, and a completed assessment is not proof that the controls it describes work in production, so the evidence still has to be tested.

Frequently asked questions

Did GM admit wrongdoing in any of these settlements?

The public announcements describe the matters as settlements of allegations. They do not state that GM admitted liability. GM announced in April 2024 that it was discontinuing the Smart Driver program at the center of these cases.

Why did Oregon not use its privacy law against GM?

Oregon said much of GM’s conduct happened before the Oregon Consumer Privacy Act took effect in July 2024, so it brought the case under its Unlawful Trade Practices Act instead.

Were California drivers’ insurance premiums raised because of the data sales?

California’s attorney general said its investigation found California drivers were not directly affected in that way, likely because California insurance law prohibits insurers from using driving data to set rates. The state pursued the case on the sale, notice and minimization issues instead.

Can a company face both an FTC order and state settlements for the same conduct?

Yes. GM’s case shows the FTC, a single state and a multistate coalition each resolving claims over the same program, with overlapping but distinct terms.

Does a state need a comprehensive privacy law to bring a data privacy case?

No. Every state has a consumer protection statute, and attorneys general have used those laws in privacy cases for years. A privacy law adds specific rules, but it is not a precondition for enforcement.

The next case will not need a broken promise

GM’s exposure was unusually clean because it allegedly promised drivers one thing and did another. As state privacy laws mature past their effective dates, enforcers will be able to bring the same kind of case against companies that promised nothing at all, simply because they sold sensitive data without the consent the statute requires. The question for every product team is which of the two punches it is more exposed to, and the honest answer for most is both.