On October 29, a bipartisan coalition of 36 attorneys general, co-led by Washington and Oregon, announced a $220 million settlement with an automaker and its connected vehicle services subsidiary. The coalition comprises the attorneys general of 35 states and the District of Columbia, each of which entered into a similar consent judgment with the companies. The settlement resolves allegations that the companies sold consumers’ driver behavior and location data to third parties, including data brokers that allegedly resold the data to insurers, without consumers’ consent. According to the press release, the coalition found that the companies enrolled millions of drivers in a driving-habits program from 2016 to 2024 and told them that their data would not be shared with insurers without express consent. The press release also stated that dealership employees allegedly accepted terms and conditions on customers’ behalf, and that the companies’ app incorrectly told more than 370,000 enrolled drivers that they were not enrolled. The companies did not admit any violation or liability.

Under the settlement, the companies must, among other things: (i) obtain consumers’ “Affirmative Express Consent” before collecting or using covered driver data, or disclosing it to any third party; (ii) ask third parties that received covered driver data before January 16, 2025 to delete it, except where legal or regulatory requirements apply, and not sell or disclose such data to any of those third parties until the recipient confirms receipt of the request and, for a consumer reporting agency, confirms in writing that the data has been deleted or is subject to legal or regulatory requirements that prevent deletion; (iii) maintain a comprehensive privacy program overseen by a chief privacy officer with data protection assessments and independent third-party assessments; and (iv) train dealership personnel so that consumers accept privacy disclosures themselves before enrolling.