The detail in this case that should worry a website owner isn't the dollar figure. It's that GM's own app told more than 370,000 drivers they weren't enrolled in data collection while, according to the states, their data kept being collected and sold. A settings screen that says one thing while the system does another is a problem any site with a consent banner can have.
What Happened
On October 29, 2026, a coalition of 36 attorneys general, co-led by Oregon and Washington, announced a $220 million settlement with General Motors. The states allege that from 2016 to 2024 GM's Smart Driver program tracked drivers' habits, including trip times, hard braking, rapid acceleration and speeding, and that GM sold that driving data and location information to data brokers, who sold it to insurers. Some insurers then changed premiums based on it.
Oregon's announcement says most drivers were enrolled at purchase through a single sign-up that also covered OnStar, and alleges that dealership staff sometimes accepted the terms on customers' behalf. Then there's the OnStar app, which wrongly told those 370,000-plus drivers they weren't enrolled. Under the settlement GM must get affirmative, express consent before collecting or sharing driving and location data, limit what it collects, run a privacy program with internal and external assessments, and train and oversee dealerships so nobody gets enrolled without consent.
California isn't in the coalition because it already acted. On May 8, Attorney General Rob Bonta and four district attorneys, supported by CalPrivacy, announced a $12.75 million CCPA settlement with GM, still the largest CCPA penalty on record. That complaint said GM sold Californians' driving data to Verisk and LexisNexis Risk Solutions from 2020 to 2024 while its privacy policy said it didn't sell driving or location data.
What Website Owners Should Take From It
Most sites don't sell telematics, but nearly all of them make claims about tracking: in a cookie banner, a "Do Not Sell or Share" toggle, a privacy policy. Regulators across both cases judged GM on whether those claims matched what the system actually did. On the web that means a few concrete checks.
- After a visitor opts out, the ad pixels have to stop. § 7026(f) requires a business to stop selling and sharing once it receives the request, so a toggle that saves "opted out" while your tags keep firing is the GM app in miniature. California has already priced the web version: Healthline paid $1.55 million in July 2025 partly because its consent banner appeared to turn off tracking cookies and didn't.
- Bundled sign-ups don't count as consent. § 1798.140(h) says accepting general terms of use isn't consent, and neither is agreement obtained through dark patterns.
- Reread your policy's "we do not sell" sentence next to your tag manager's container. California's complaint turned on exactly that gap.
Where Privisy Fits
Privisy scans websites, not vehicles or mobile apps. What it can do is the web version of the check that would have caught GM's app: a full audit loads your site, records which trackers fire, revisits with a Global Privacy Control signal, and follows your opt-out link. When that link leads to a working opt-out, the audit completes it in a fresh browser, reloads your pages and reports whether advertising beacons kept sending visitor identifiers afterward. That last finding is advisory for now; it tells you where to look rather than issuing a verdict.
Check What Your Opt-Out Actually Does
Run a full audit to see which trackers keep firing after a visitor says no.
Get Your Audit