[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4_FHW_afS1s4QLhhpqE6jZYtbnGe-9FekV6oFB0Mpzc":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"d3e88284-7923-40fa-a89e-fd5ae770f42d","GM cracks the petty cash box for multistate driver tracking settlement","gm-cracks-the-petty-cash-box-for-multistate-driver-tracking-settlement-6e0c4e","$220 million? For all of you? Yeah, we can probably dig that up ...","General Motors has reached a $220 million settlement with 36 states and the District of Columbia over allegations of collecting and selling driver data without proper consent. The data, including precise location and driving metrics, was sold to brokers who supplied it to insurance companies for premium setting. GM also incentivized dealerships to enroll customers without their knowledge and misled drivers about their enrollment status.","GM agrees to $220 million settlement with 36 states over driver data collection and sale.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F30\u002Fgm-cracks-the-petty-cash-box-for-multistate-driver-tracking-settlement\u002F5306721","https:\u002F\u002Fimage.theregister.com\u002F?imageId=229334&width=800","2026-10-30T16:48:37+00:00","2026-10-30T17:00:07.466833+00:00",7,[17,20,23],{"name":18,"type":19},"General Motors","vendor",{"name":21,"type":22},"Smart Driver","product",{"name":24,"type":22},"OnStar","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,46],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":47},{"id":25,"icon":27,"name":28,"slug":29},[],[18,21,24],{"controls":51,"vendors":127},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":82,"name":83,"problem":84,"products":85},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"slug":111,"name":112,"problem":113,"products":114},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[115,121],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":123,"url":125,"description":126},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":140},"gms-220m-settlement-highlights-risks-of-unauthorized-driver-data-collection-and-sale","GM's $220M Settlement Highlights Risks of Unauthorized Driver Data Collection and Sale","General Motors collected granular driver data — including precise location and driving behavior metrics — and sold it to data brokers and insurance companies without meaningful consumer consent. GM compounded the violation by incentivizing dealerships to silently enroll customers and actively misleading drivers about their enrollment status, stripping them of any real opportunity to opt out. This case illustrates how organizations can weaponize consumer data for commercial gain while circumventing the foundational privacy principles of transparency, consent, and purpose limitation. The $220 million price tag demonstrates that regulators are increasingly willing to impose significant financial consequences for data monetization schemes that bypass consumer rights. Any organization that collects, processes, or shares personal data must treat consent and disclosure as legal obligations, not optional courtesies.",[133,134,135,136,137,138,139],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":141,"NIS2 Article 21(2)(b)":142,"NIST SP 800-53 SI-2: Flaw Remediation":143,"CIS Control 17: Incident Response Management":144,"CIS Control 14: Security Awareness and Skills Training":145,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":146,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":147},"While a US case, GDPR's principle of processing personal data only with a lawful basis and explicit consent directly mirrors the consent failures GM exhibited; organizations subject to GDPR could face even steeper penalties for the same conduct.","NIS2 mandates incident handling and risk-management measures that cover supply-chain and third-party data relationships; the broker arrangement through which driver data reached insurers represents exactly the kind of third-party risk that these controls are designed to govern.","Although a process flaw rather than a technical one, NIST's requirement to identify and correct systemic deficiencies applies here — GM's dealership enrollment workflows were a known procedural gap that was never remediated.","GM lacked an effective internal response mechanism to detect and halt the unauthorized enrollment and data-sale scheme before it scaled across millions of customers and triggered a multistate investigation.","Dealership staff who enrolled customers without consent either were not trained on privacy obligations or were given commercial incentives that overrode that training — structured awareness programs for all data-handling personnel would have closed this gap.","ISO 27001 requires organizations to assess and address risks arising from their own systems and processes; a formal risk review of the connected-vehicle data pipeline would have surfaced the consent-bypass vulnerability before it became a liability.","Proper identity and consent management for data subjects — ensuring only authorized, consented data flows are permitted — would have prevented the unauthorized sharing of driver profiles with brokers."]