Start with Context: What Was the Data Collected For?
For GM and OnStar, the first privacy question is not whether a connected car can produce driving data; it is what the service relationship told California consumers that data was for. This chapter separates notice, consent, opt-out, and the right to limit sensitive information, then uses the alleged OnStar and Smart Driver practices to show how a consumer choice must follow the actual data path. The goal is a practical judgment: can the stated service purpose still explain what happens to the record?
Collection is a context, not an accident
The complaint describes OnStar as a connected vehicle service and Smart Driver as an included, app-based feature that gave subscribers feedback on driving habits such as hard acceleration and hard braking. It alleges that GM also collected precise geolocation to support functions such as summoning an ambulance after a crash or providing turn-by-turn directions. Those descriptions are allegations in the People of California’s complaint, but they identify the consumer-facing context that matters before any dispute about later disclosure is considered.
A service does not need to collect a piece of information for only one conceivable reason. A location signal might support emergency response, navigation, vehicle recovery, diagnostics, or another function. The important discipline is to identify the purposes that actually justify collection and to tell the consumer what those purposes are. A broad statement that a company may use information for “business purposes” does not by itself explain why a particular driving event or location point is needed.
The CCPA treats “collection” broadly. It includes buying, renting, gathering, obtaining, receiving, or accessing personal information by any means, including observing a consumer’s behavior. Personal information includes identifiers, commercial information, electronic-network activity, geolocation, and inferences, among other categories. That language fits a connected-car environment: information can be generated passively by a vehicle, associated with an account, and later combined with other records without a driver taking a separate action for each event.
This makes the initial purpose more than a sentence in a policy. It is the baseline against which later processing can be understood. If a consumer activates Smart Driver to receive feedback, the service context points toward the information needed to calculate and deliver that feedback. If OnStar uses location to respond to an emergency, the context points toward information needed for that response. Neither example automatically answers how long the information may be kept or whether it may be sent to a data broker. It does, however, make those later questions concrete.
The purpose also has to be read at the level of the field and the audience. “Driving data” can sound like one thing, but a hard-braking event, a speed measurement, a trip duration, an account name, and a precise location do different work. A service may need one field to provide feedback and another to respond to a safety event. Sending all of them to the same recipient would still require a separate explanation of why that recipient needs each one. The complaint’s alleged contrast between Verisk’s restriction on precise geolocation and Lexis’s receipt of GPS information illustrates why a broad category can conceal a material difference.
The audience for the information is part of the context too. A consumer may expect a service operator to receive information needed to operate the service, while a disclosure to a data broker introduces a party with a different relationship to the consumer. The CCPA’s requirement to disclose whether information is sold or shared recognizes this distinction. It asks the business to describe not only what it collects and why, but also whether the record will enter a downstream commercial channel.
This does not mean that every later recipient is automatically outside the original purpose. A service provider may need information to perform the service, and the judgment preserves functions such as emergency response, safe operation, diagnostics, and warranty administration. The key is to connect the recipient and the field to that function. A location point used to answer a consumer-initiated request is easier to explain in context than a historical location record transferred for an unrelated product. The legal and factual analysis may differ, but the relationship must be made visible.
The strongest evidence for that analysis would be concrete: the notice shown at enrollment, the consent language for each feature, the data fields transmitted, the settings or signals that recorded a consumer’s choice, and the recipient-specific agreements. The complaint alleges a mismatch among those pieces. The judgment imposes new requirements on GM. Until the underlying notices, systems, and contracts are examined, the careful conclusion is not that every allegation is proved, but that the alleged mismatch identifies exactly where the lifecycle needs testing.
Four controls answer four different questions
Privacy language often treats every form of consumer choice as “consent.” The CCPA does not. Notice, consent, opt-out, and the right to limit sensitive information operate at different points in the lifecycle and protect against different failures.
Notice tells the consumer what is happening. At or before collection, the CCPA requires a business that controls collection to disclose the categories of personal information being collected, the purposes for which they are collected or used, and whether the information is sold or shared. The business must also disclose the intended retention period for each category, or the criteria used to determine it, when that is possible. The notice gives the consumer a usable description of the bargain: these kinds of information, for these reasons, with this kind of downstream treatment and duration.
A notice is not adequate merely because it exists somewhere. The law requires information that is understandable and reasonably accessible, and the GM judgment requires OnStar enrollment notices to be clear, conspicuous, plain, straightforward, truthful, accurate, and not misleading. The judgment also requires dealer-facing documents and programs to instruct dealership personnel to give California OnStar customers an opportunity to review and consent to applicable privacy notices before enrollment. In a connected-car sale, the moment of enrollment can therefore be part of the privacy control, not just a commercial handoff.
Consent records an affirmative agreement for a defined purpose. Under the CCPA’s definition, consent must be freely given, specific, informed, and unambiguous. Agreeing to a broad terms-of-use document that happens to contain privacy language is not automatically consent to every later use. The judgment makes this especially concrete for covered driving data: GM must obtain consent before collecting, using, or disclosing that data to a third party when the requirement applies, and each separate, unrelated service or feature that involves such activity requires its own consent.
That is a different question from whether the consumer was told that the service collects information. Notice can inform; consent can authorize a defined action. A consumer may understand that Smart Driver records hard braking without agreeing that the same record may be used to create an insurance-related rating product for someone else. The validity of a later use cannot be established simply by pointing back to an earlier enrollment screen.
Opt-out is a direction to stop a sale or sharing. The CCPA gives a consumer the right to direct a business that sells or shares personal information to stop doing so. A business subject to those duties must provide a reasonably accessible way to exercise the choice, including the required link or an appropriate opt-out preference signal under the statutory framework. The business may not require an account or additional information beyond what is necessary to carry out the direction.
An opt-out is therefore not the same as declining initial collection. It is a control over a qualifying downstream practice. A consumer might continue using a connected-car service while directing the business not to sell or share personal information. If the business accepts the direction on its website but continues sending the relevant records to a recipient through a separate system, the consumer has not received the protection the choice was supposed to provide.
The right to limit sensitive information narrows permitted use. The CCPA separately recognizes a consumer’s right to direct a business that collects sensitive personal information to limit its use and disclosure to specified necessary or reasonably expected services and other listed purposes. Precise geolocation is one of the categories the statute treats as sensitive personal information. The question here is not simply whether information was sold for consideration. It is whether a sensitive field is being used or disclosed beyond the uses the law allows after the consumer gives the direction.
The distinctions matter because a single interface can hide several decisions. An enrollment flow might provide notice about vehicle telemetry, ask for consent to a particular feature, offer an opt-out from sale or sharing, and provide a separate way to limit sensitive information. A business that labels all four “privacy preferences” may still fail if one choice does not govern the field, purpose, or recipient it appears to cover.
A choice must reach the data path
The complaint alleges that GM’s enrollment language described sharing in terms of developing or improving the safety, security, and quality of its services, or responding when a consumer had elected to receive a third-party service or authorized a request. It also alleges that Smart Driver was presented as a way to provide insights into driving behavior and identify opportunities for improvement. According to the complaint, GM’s CCPA notice denied that it sold characteristics, behavior, or geolocation data, even though GM allegedly sold driving behavior data to LexisNexis and Verisk and geolocation data to Lexis.
The complaint further alleges that GM offered consumers a way to opt out of sales, including through its website, but that the mechanism had no effect on data going to those brokers. If that allegation were established, the problem would not be merely unclear wording. It would be a control-path failure: the consumer’s direction would stop at an interface while the underlying transfer continued.
A useful way to test a choice is to follow a single field. Start with a hard-braking event or a location point produced by the vehicle. Identify the system that receives it, the stated service that uses it, any retained copy, and every recipient that can receive it. Then ask which notice described the flow, which consent—if any—authorized the particular use, and which mechanism can stop or limit the transfer. If the answer changes when the record moves from the vehicle service to a separate broker feed, the business needs to explain that transition rather than treating the original choice as universal.
The diagram does not mean every disclosure requires identical consent, or that a consumer can disable every collection event. The CCPA and the judgment preserve specific exceptions. The judgment, for example, allows covered driving data to be collected, used, or disclosed for listed purposes such as responding to emergency responders, answering a consumer-initiated communication, addressing safe vehicle operation, complying with lawful requests, conducting specified product and safety work, detecting cybersecurity incidents, fulfilling warranties, and performing diagnostics under stated conditions. These exceptions are tied to functions; they are not a general permission to use the data for an unrelated commercial purpose.
The difference between a bounded exception and a broad reuse is the difference between a service response and a new data relationship. If a vehicle-initiated communication requires data to address safe operation, the judgment permits the use only to provide that response. If a diagnostic issue concerns a specific vehicle, identification may be necessary, while third-party disclosure for that purpose is otherwise limited to deidentified data under the judgment’s conditions. Control therefore depends on both the purpose and the granularity of the information sent.
The enrollment promise has to survive later decisions
The alleged GM/OnStar practices show why collection context should be treated as an active boundary. A consumer-facing explanation of navigation, emergency assistance, or driving feedback may support collection for those services. It does not silently answer whether a data broker needs the same fields, whether an insurer-related product is compatible with the original context, or whether the record should remain available years later. Those questions belong to the next lifecycle transitions.
For now, the practical test is straightforward. At enrollment, can a consumer understand the categories collected, the purposes, sale or sharing, and intended retention? When a separate feature or unrelated recipient enters the picture, is there a specific and meaningful control where the law requires one? When the consumer exercises a choice, does the instruction reach the systems and recipients that handle the data? And when an exception preserves a safety or legal function, is the use limited to that function?
The complaint’s account of GM’s statements and controls remains an allegation, while the judgment’s notice and consent provisions are operative requirements imposed on GM. Keeping those statuses separate does not weaken the lifecycle analysis; it makes the analysis more reliable. The central point is that a privacy choice has meaning only when it is connected to a purpose, a field, a recipient, and a real transition in the data flow. Once that boundary is clear, the harder question is whether the same record can be turned into a new product without becoming a new purpose.