GM agrees $220 million settlement with 36 attorneys general over driver data sold to brokers

This is a privacy enforcement action rather than a technical vulnerability, and the articles give no CVE IDs. The 36 attorneys general allege GM collected identifiable driving data through Smart Driver without informed consent and sold it to brokers that supplied insurers, despite telling customers it would not share it with insurers without express consent. The settlement requires limits on data collection, stronger PII protection and a comprehensive data privacy programme, and follows the FTC order requiring express consent, data access and deletion options, and the ability to disable precise geolocation where supported. A Texas case is still ongoing. Defenders handling connected-vehicle or telematics data should review consent flows, third-party data sharing and the accuracy of in-app enrolment status.

For security analysts · Written by AI from 1 source · Wrong?