Enforcement update, 3 November 2026: 36 states and GM's USD 220 million Smart Driver settlement

What happened. On 29 October 2026, a coalition of 36 attorneys general led by Oregon and Washington announced a USD 220 million settlement with General Motors. The states alleged that GM sold drivers' Smart Driver data to data brokers, who sold it on to insurers (Oregon DOJ). According to the states, GM enrolled millions of drivers between 2016 and 2024 and pitched the program as a way to drive more safely. It also told drivers it would not share their data with insurers without their express consent. The data covered trips, start and end times, hard braking, hard acceleration and speeding.

The states also allege that enrollment came bundled into a single sign-up at the dealership, that dealership employees sometimes accepted the terms on customers' behalf, and that sales bonuses were tied to enrollment. They say the OnStar app told more than 370,000 drivers they were not enrolled when they were. "People bought a car, not a tracking device," said Oregon Attorney General Dan Rayfield.

Going forward, GM must get drivers' affirmative express consent before it collects or shares driving and location data. It must also run a data minimization and privacy program, get internal and external assessments, and oversee and train its dealers. Oregon's stipulated judgment takes effect on 30 November 2026, and GM does not admit any violation (Oregon stipulated judgment). New York's share is USD 12,054,341 (New York Attorney General).

Why it matters. This is a consent case without a cookie banner. The states' account has every familiar failure: consent bundled into another step, someone else clicking "accept," incentives that rewarded enrollment, and a status screen that told users the wrong thing. Under this settlement, consent has to be affirmative and express, and the data flows have to match what users were told. If your product says users are not enrolled, nothing should be collecting their data.

Montana is not part of the coalition. It sued GM separately on 16 October, and that case continues (case record).

Read the case record.

What happened. The CNIL announced on 29 October 2026 that it had fined two FNAC Darty companies a total of EUR 7 million under Article 82 of the French Data Protection Act: EUR 6 million for FNAC Darty Participations et Services and EUR 1 million for FNAC Direct. The case started with a complaint from noyb, and the CNIL inspected the FNAC mobile app in March 2024. It found that the app sent requests to a third-party domain with a user identifier and the products viewed, to power recommendations and train algorithms, without consent. It also found that the app did not respect users' refusal. FNAC must show compliance within one month of notification or pay EUR 10,000 per day of delay (CNIL).

Why it matters. The cookie rules apply to apps, not only websites, and to API calls, not only cookies. A recommendation service that receives an identifier and browsing history is a tracker if it runs before consent or after refusal.

Read the case record.

What happened. California's attorney general announced a USD 1.8 million settlement with Lyft on 29 October 2026. The state alleged violations of the CCPA and the Unfair Competition Law. According to the attorney general, Lyft operates only through its app and, since mid-2023, has sold or shared personal information, including non-precise location such as city or ZIP code, to target ads inside the app. It offered no opt-out inside the app. Users had to follow links from the in-app privacy policy to a "Do Not Sell or Share" web page, then log in and enter personal information again. The settlement requires an in-app opt-out and a notice to California consumers of their right to opt out (California Attorney General). The case came out of the state's March 2025 sweep on location data.

Why it matters. "We have an opt-out page" is not enough if users have to leave the product, log in again and retype what you already know. The opt-out should sit in the same app or site where the selling or sharing happens.

Read the case record.

In re Meta Pixel Healthcare: classes certified (30 October 2026). In the consolidated case over Meta's pixel on healthcare providers' websites and apps, Judge William Orrick granted class certification "except for the limited Section 631 and redefined CDAFA class." Plaintiffs must file a revised class definition within 10 days and a proposed notice plan within 30 days (order, Dkt. 1425, on govinfo). The court also denied Meta's motions to exclude the plaintiffs' experts. Meta argued that its own data could not show which healthcare sites had its tools set to collect protected information. The court said that debate goes to cross-examination, not exclusion. The claims are still allegations; certification is not a ruling on the merits. The library record shows the earlier stage, and an update is in review. Case record.

McKie v. Huel: banner helped plaintiffs, standing did not (26 October 2026). A federal judge in San Francisco held that Huel's opt-out cookie banner, with "Accept," "Required only" and "Cookie Settings" choices, created a plausible expectation of privacy. Even so, the court found that tracking grocery-style meal purchases and checkout contact details during one visit to one site was not "highly offensive." It dismissed all claims for lack of standing, with leave to amend within 30 days (order, Filing 28, on Justia). The banner wording still mattered: offering a "Required only" choice is a promise your tags have to keep. Case record.

In re Meta Android Privacy Litigation: second motion to dismiss decided (2 November 2026, in review). The plaintiffs allege that Meta changed its pixel to send the _fbp cookie to localhost ports on Android devices, where the Facebook and Instagram apps were listening, which let Meta link web browsing to Meta accounts. In May, the court let most claims proceed (order, Dkt. 120, on govinfo). The docket shows a second order on Meta's motion to dismiss on 2 November. According to MLex, the judge found the plaintiffs plausibly alleged that Meta exceeded the scope of users' consent. She dismissed the pen register claim because California's SB 690 removed the private right of action. We have not read the new order yet, so treat that summary as press reporting. These are allegations, not findings. The record is drafted and in review.

Flo, Google and Flurry: final approval signaled. At the 29 October hearing, Judge James Donato said he would grant final approval of the USD 56 million Google and Flo settlements, and cut the plaintiffs' fee request by 5% (Courthouse News). As of the 2 November docket, we have not seen a signed order. Case record.

Frasco v. Meta: no judgment yet. After the August jury verdict against Meta, the plaintiffs asked for a USD 1.11 billion partial judgment, which has not been entered. At the same hearing, the judge ordered the plaintiffs, Meta and Covalynt, the company helping identify class members, to meet the week of Thanksgiving and resolve their disputes (Courthouse News). Case record.

Tenet Healthcare: one settlement for a hospital system (in review). A Tennessee state court preliminarily approved a settlement on 22 September 2026 covering about 1.2 million people who used Tenet websites or patient portals to create an account, submit a web form or check in to urgent care or an emergency room. Plaintiffs alleged that the sites disclosed health information to Meta, Google and others. Class members can claim USD 16 and two years of identity protection, and the final approval hearing is on 14 January 2027 (preliminary approval order). Tenet denies wrongdoing. The record is drafted and in review.

Penn Medicine: hearing moved. The settlement website now lists the final approval hearing on 3 December 2026, moved from 12 November (Penn Medicine settlement FAQ). The library record still shows the old date, and an update is in review. Case record.

Why it matters. Hospital portals, check-in forms and health apps keep coming up. The settlements define their classes by those sensitive actions, not by general browsing.

Times are given in US time with GMT in parentheses.

• 5 November, 2:00 PM ET (7:00 PM GMT): final approval hearing for the USD 1.765 million Cone Health settlement (case record).
• About 9 November: revised class definition due in In re Meta Pixel Healthcare.
• 12 November: amended complaint due in In re Google Cloud Contact Center AI.
• About 13 November: deadline to petition the Ninth Circuit for permission to appeal the Meta Pixel Healthcare class certification order, and the latest likely end of the European Wax Center appeal window (that order's date is unconfirmed).
• About 19 November: LifeStance Health appeal window closes (case record).
• Week of 23 November: Frasco v. Meta parties meet on class member identification.
• 25 November: opposition due to the motion to dismiss in FTC v. Hims & Hers (case record), and about the same day, the amended complaint deadline in McKie v. Huel.
• 30 November: Oregon's judgment in the GM settlement takes effect.

We are also watching for the signed Flo final approval order and for an amended privacy claim in Evans v. MH Sub I, which was due about 3 November. We have seen neither.

This week's cases share one theme: consent that exists on paper but not in the flow.

• Status screens. If your app tells users they are opted out or not enrolled, confirm that nothing is collecting or sharing their data.
• Refusal in apps. Test refusal in your mobile app as well as on your website, including calls to recommendation and analytics APIs.
• Opt-out placement. Put the "Do Not Sell or Share" control inside the product, and don't make signed-in users log in or retype their details.
• Banner promises. If your banner offers "Required only," check what loads after someone picks it.
• Sensitive flows. List every tag on portal sign-up, check-in and booking pages.

We build Inth around compliance as code: checks that run where the change happens. Code Audit flags a pull request that adds a tag or SDK call outside the consent check. Website Audit records what loads before a choice and after Reject. Neither can tell you what a dealer said at the counter, what a vendor did with data after it arrived, or which laws apply to you.

An allegation is not a finding, and a settlement does not establish liability. Where a case is still open, we say so. Each record is a dated summary of its sources, so check the stage and review date before you rely on it. This update is not legal advice.

Browse the enforcement library, or run a free codebase scan to see which of these patterns show up in your own code.

• Oregon DOJ press release on the GM settlement, 29 October 2026
• Oregon v. General Motors, stipulated general judgment
• New York Attorney General press release on the GM settlement
• CNIL, sanction against FNAC, 29 October 2026
• California Attorney General press release on Lyft, 29 October 2026
• In re Meta Pixel Healthcare, class certification order (Dkt. 1425), 30 October 2026
• McKie v. Huel, order (Filing 28), 26 October 2026
• In re Meta Android Privacy Litigation, order (Dkt. 120), 11 May 2026
• MLex, 2 November 2026
• Courthouse News, 29 October 2026
• Doe v. AMISUB (Tenet Healthcare), preliminary approval order
• Penn Medicine settlement FAQ