PRIVACY & DATA SECURITY
GM’s $220 Million Settlement Shows Disclosure Gaps Are Enforceable Without a Privacy Statute
A coalition of 35 state attorneys general and the District of Columbia has settled with General Motors for $220 million over claims that the company illegally sold consumers’ driving behavior and location data without consent. The data came from Smart Driver, a program that gathered it from more than 10 million drivers and sold it to data brokers serving insurers. Between 2016 and 2024, GM allegedly enrolled drivers by pitching the program as a safety tool and assuring them their data would not reach insurers without express consent. The AGs say the data, which covered when and how often people drove, hard braking, rapid acceleration, and speeding, was instead provided under contracts that named insurance use as the purpose, and that some drivers ended up paying higher premiums.
The AGs also took issue with how drivers got into the program. Enrollment generally happened at the dealership through a single sign-up process that bundled Smart Driver with OnStar. In some cases, dealership employees allegedly accepted the terms on the customer’s behalf without consent, with GM encouraging this by paying sales staff bonuses and ranking dealerships based on how many customers they enrolled in connected services. Separately, the OnStar app wrongly told more than 370,000 drivers they were not enrolled, and GM later unenrolled them without explanation while leaving their data with brokers and insurers.
Beyond the payment, GM must get affirmative express consent before collecting or sharing driving and location data, limit what information it collects, run a comprehensive privacy program subject to internal and external assessments, and put oversight and training in place at its dealerships. The settlement provides no restitution to drivers, and each state can decide how to use its share.
BUSINESSES NEED TO KNOW: The through line in this settlement is disclosure. For much of the period at issue, many states had no comprehensive privacy statute, so attorneys general worked under their unfair and deceptive practices (UDAP) laws, and the theory was a simple one: GM told drivers one thing about how their data would be used and did another.
Why is that significant? Because it means data privacy exposure doesn’t just depend on whether a state has a privacy law. If what you tell consumers in privacy policies, enrollment flows, product marketing, and point-of-sale scripts doesn’t match what happens to their data, every state AG already has the authority to act. Disclosures must be accurate when written and stay accurate as data practices change, including when data moves through third-party sales channels. The enrollment moment deserves particular care, because consent that is bundled with another service, rushed, or given by someone other than the consumer is hard to defend as consent.
Moreover, the cost of getting it wrong also extends well past the big-ticket settlement. Beyond the $220 million, GM now faces ongoing obligations to limit what it collects and to obtain affirmative express consent before collecting or sharing this kind of data going forward. Obligations like these reshape how a business operates for years, can constrain product and revenue strategy, and often come with oversight that creates its own burden.
TCPA & TELESERVICES
FCC Removes Digital Solutions From the Robocall Mitigation Database
On October 5th, the FCC announced it had removed Digital Solutions, Inc. from the Robocall Mitigation Database (RMD), giving network providers 30 days to start blocking its traffic and effectively cutting it off from U.S. phone networks. The matter began with prerecorded calls pitching loans and tax relief that the Industry Traceback Group traced to the company and that appeared to lack consent. The Enforcement Bureau sent a formal notice in April demanding a prompt report on mitigation and an investigation of the flagged traffic. Digital Solutions did not dispute that the calls ran through its network, pointed to three of its customers as the source, and fixed one of two deficiencies the FCC identified in its RMD certification. But the company’s response left out information the rules require, and the second problem, a mismatch between its STIR/SHAKEN certification and its actual network, was never cured, even after the Bureau issued a show-cause order giving it another chance.
BUSINESSES NEED TO KNOW: You don’t have to be a voice provider for this action to reach you. If your business runs outbound calling or texting campaigns, those campaigns are only as stable as the carriers behind them, and a provider can be cut off with just a month’s notice. Ask your vendors about their RMD status, keep a backup route in place, and be ready to produce consent records for any call on short notice, since lack of consent was the basis for the traceback here. If you’re a provider, make sure your RMD certification matches how your network actually operates, and treat any regulator notice as a deadline-driven project. Partial cooperation wasn’t enough for Digital Solutions, and still resulted in removal.
Read more lessons on this matter and best practices for responding to an enforcement inquiry on our recent blog post.
A Florida Federal Court Questions the Foundation of National Do Not Call Lawsuits
A Florida federal court dismissed a National Do Not Call Registry claim on grounds that could reach well beyond one case. In Internicola v. MortgagePros, LLC, the plaintiff, whose number had been on the Registry since 2008, contacted the company about refinancing in April 2025, withdrew his consent on July 1, 2025, and alleged he then received just over a dozen calls and texts in about ten days. The court’s order threw out the Do Not Call claim on two separate grounds.
First, the court agreed that a text message isn’t a “telephone call” under the TCPA’s private right of action, which covers people who receive “more than one telephone call” in a 12-month period. That follows the Seventh Circuit’s similar July 2026 decision in Steidinger v. Blackstone Medical Services, the first federal appellate ruling on the question.
The second ground is the more novel one. The court concluded that the private right of action under the TCPA does not exist for claims based on the national registry at all. Section 227(c)(5) of the TCPA allows suits for violations of regulations “prescribed under this subsection,” which the court read as being limited to the rules the FCC wrote in response to Congress’s original 1991 directive. These rules, however, only called for company-specific internal lists. The national registry came later, in 2003, through a separate statute that doesn’t create a private lawsuit of its own. If that reasoning spreads, the registry would remain enforceable by regulators but not by individual plaintiffs and class counsel.
One district court order doesn’t necessarily bind other judges or courts, and an appeal to the Eleventh Circuit has been filed, so this is a development to watch, not a settled rule. It also leaves autodialed and prerecorded call claims, state telemarketing statutes, and government enforcement untouched. Our blog post walks through the court’s reasoning and what it could mean for TCPA litigation going forward.
BUSINESSES NEED TO KNOW: Treat this ruling as a reason to raise, not loosen, your compliance program. Keep scrubbing against the registry where required, maintain an internal do-not-call list, honor revocations promptly, and document consent, since regulators, state law claims, and other TCPA provisions remain fully in play, and plaintiffs are likely to shift claims toward them. If you’re sued on a Do Not Call theory, talk with litigation counsel early about whether the text-message and registry arguments are available in your case, and keep an eye on the Eleventh Circuit.
ADVERTISING & MARKETING
FTC Puts Health Plan Marketers and Lead Generators on Notice as Open Enrollment Begins
With ACA open enrollment underway, the FTC has sent warning letters to 25 companies that market healthcare plans or generate sales leads for them, with more letters planned on a rolling basis. The recipients advertise ACA Marketplace coverage as well as products like limited indemnity plans and medical discount programs. The letters identify four kinds of claims the FTC views as likely to violate the law, including 1) misstating a plan’s benefits or limits, 2) presenting a plan as major or comprehensive medical insurance when it isn’t, 3) misstating its cost, and 4) promising free offers, cash rewards, rebates, or other incentives that enrollees won’t actually receive or that are subject to undisclosed conditions. The letters also point to a list of past FTC cases against marketers and lead generators in this space.
Importantly, the letters don’t allege wrongdoing by any recipient, and they are not an enforcement action. They are merely a notice, asking companies to review their advertising and signaling that the agency is watching this market closely. Still, a warning letter shifts the ground under the company that receives one, because it becomes harder to claim surprise at the FTC’s view if similar claims turn up later. The timing and the audience are worth noting too. Landing these letters in the middle of open enrollment, and sending them to lead generators as well as the companies selling plans, highlights that the FTC views the whole chain of advertising as accountable.
BUSINESSES NEED TO KNOW: You don’t need to have received a letter for this to be on your radar, since more are coming and the same claims can also draw scrutiny from state attorneys general. Now is a good time to review your own advertising, before a regulator does it for you.
- Audit while the ads are live. Compare ad copy, call scripts, landing pages, and emails against what each plan actually covers and costs, paying particular attention to products that aren’t ACA coverage but may read like it.
- Treat “free” and “rewards” as claims you have to back up. If an incentive comes with conditions, or isn’t delivered to every enrollee, the advertising needs to say so clearly and the offer needs to be real.
- Look upstream and downstream. If you buy or sell leads or run affiliates, you’re accountable for what your partners say on your behalf, so make sure your contracts and monitoring reflect that.
- Ensure all Disclosures are Clear and Conspicuous. Any material conditions or terms must be presented to the consumer in a clear and conspicuous manner. Do not bury important disclaimers at the end of a script or at the end of a landing page, or present them in a way that a consumer is unlikely to understand.
Consumer Protection Law Meets B2B as FTC and States Target Toast’s Fees and Subscription Practices
The FTC, seven state attorneys general and California prosecutors in Los Angeles County and San Francisco have sued Toast Inc., the restaurant software and payments company, alleging that it misled its small business customers about what they would pay, what they would get, and how easily they could leave. The complaint brings claims under the FTC Act, the Restore Online Shoppers’ Confidence Act (ROSCA), and related state laws.
The allegations center on fees. Toast sells restaurants hardware, software, and payment processing through auto-renewing subscriptions, and the plaintiffs say customers were enrolled in and charged for add-ons like payroll and timekeeping without their consent. They also say Toast’s “Pay-as-you-Go” plan, advertised as $0 per month for hardware and software, actually came with undisclosed costs, such as a requirement to return the hardware or pay its full retail value if a restaurant didn’t start processing payments within 120 days, a monthly processing charge even when a restaurant had temporarily closed, and a monthly early termination fee for each remaining month of the contract. The complaint adds that Toast tacked a $0.99 fee onto certain online orders, with that money going to Toast, not the restaurants.
Cancelling was allegedly harder than signing up. Restaurants had to give 30 days’ written notice of their intent not to renew, a requirement the complaint says wasn’t clearly disclosed at enrollment. Many restaurants then ran into unanswered requests, retention pitches, and large termination charges. The plaintiffs in the lawsuit also say that canceling or switching providers could trigger the immediate acceleration of balances on Toast Capital loans, which made leaving even costlier. Toast has said it strongly disagrees with the allegations, and argues that no court has held ROSCA applies to negotiated business-to-business contracts.
BUSINESSES NEED TO KNOW: Consumer protection laws are not being used just to protect consumers. This case is one of a growing number in which regulators apply familiar consumer protection concepts, such as clear pricing, informed consent, easy cancellation, and truthful service promises, to protect small businesses as the customers. The question of whether ROSCA reaches negotiated business-to-business agreements is contested, and Toast plans to argue it doesn’t, but the FTC and a bipartisan group of states have shown they are willing to test it. If you sell to businesses, don’t assume that a commercial contract, or a customer who is a business owner rather than an individual, takes you outside this body of law.
Learn how we can help keep you in compliance and ahead of the regulatory curve. Let’s Talk
Want to receive Regulatory Roundups right to your inbox? Subscribe.