Privacy / Regulation / Metadata
GM driver-data judgment sets out privacy programme, data inventory and consent terms running to 2046
Oregon's stipulated judgment, one of the parallel multistate settlements, details what GM must build from 30 November 2026, including a disclosure inventory and a strict test for deidentified data.
The Oregon Department of Justice has published its stipulated general judgment with General Motors and OnStar. It is one of the parallel judgments in the multistate driver-data settlement, which IAPP reports totals USD220 million across 36 attorneys general. GM agreed to the terms without admitting liability, and the parties waived their right to appeal.
The terms take effect on 30 November 2026. Within 180 days, GM must run a documented privacy programme overseen by a chief privacy officer, with obligations lasting until 13 January 2046. The officer reports at least quarterly to the general counsel, annually to the CEO and annually to the board. GM must also keep an inventory of driver data that OnStar collects and discloses, assess new high-risk processing in advance and obtain separate consent for each feature.
Data linked to a VIN or a garage address cannot count as deidentified. Consumers who do not respond within 10 days of an enrolment notice must be treated as having declined.
Why it matters
The judgment turns familiar data governance controls into enforceable obligations: a maintained inventory of which data categories go to which third parties, data protection assessments before selling data or sharing location data, and due diligence and contract terms for service providers. Its definitions are also notable. 'Covered' data explicitly includes algorithmically derived data. Any identifier that can be linked back to a VIN makes data 'reasonably linkable'. Precise location is anything finer than roughly a 1,850-foot radius. Teams handling connected-device or telematics data can use these definitions as a benchmark for their own deidentification and classification rules.
Status: Decision. Stipulated judgment, appeal waived; terms effective 30 November 2026
What to check
- Check whether your data inventory records, for each category of device or telemetry data, which third parties and affiliates receive it.
- Test whether data you label as deidentified is still linkable through persistent identifiers such as device or vehicle IDs, or through linkable alternative identifiers.
- Confirm that consent flows treat silence or inaction as a refusal and require separate consent for each unrelated feature that collects or shares data.
Key dates
- Effective date of GM judgment; 180-day privacy programme and 60-day enrolment procedure clocks start
- GM privacy programme obligations under the Oregon judgment end
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Court ruling
- Authority
- Oregon Department of Justice (stipulated judgment)
- Concerning
- General Motors; OnStar
Case status: Closed · 2 steps
Enforcement trackerWho should care
- DPO
- Chief privacy officer
- Data stewards
- Legal & compliance