Privacy
GM pays $220M over driving data as FTC probes personalized pricing
Vermont nets $4.5M from GM's data-sharing settlement, France fines Fnac €7M, and the FTC questions nine firms over personalized pricing.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
GM settles multistate data-sharing case for $220 million; Vermont gets $4.5 million
Vermont will receive $4.5 million from a $220 million nationwide settlement with General Motors, resolving a 35-state plus DC investigation into GM sharing driving-habit data — seat belt use, speeds — with insurers and data brokers. Vermont Attorney General Charity Clark said GM collected data from tens of thousands of Vermonters without consent and that some drivers were charged higher rates as a result. The settlement, filed before the coalition sued, states GM admits no wrongdoing; the company ended its Smart Driver program in 2024 and says it has strengthened privacy practices. Terms include consent standards and limits on driver-data collection. The money goes to the state General Fund.
Vermont to receive $4.5M settlement from General Motors following data privacy investigation →
Topics: Data brokers
CNIL fines Fnac Darty €7 million for tracking users who refused consent
France’s CNIL fined two Fnac Darty companies a combined €7 million after its app kept sending browsing activity to a product recommendation service even when users clicked Continue without accepting. Decision SAN-2026-015, adopted October 22, 2026, hit Fnac Darty Participations et Services for €6 million and Fnac Direct for €1 million, and ordered compliance proof within a month or €10,000 per day. The case began with a September 2023 noyb complaint; a March 2024 audit found requests carrying a Fnac user identifier and viewed products going to a third-party domain after refusal. The committee rejected the strictly-necessary exemption, noting the app had over 1.5 million French downloads and about 37,400 daily users.
CNIL fines Fnac €7m after its app tracked users who refused consent →
Topics: Online trackingGDPR fines
Cardenas campaign site exposed voting histories of 1.5 million Chicago voters
Chicago mayoral candidate George Cardenas’s campaign website left the home addresses, birth years and voting histories of more than 1.5 million Chicago voters publicly accessible, the Better Government Association’s Illinois Answers Project found. A password-protected dashboard for campaign workers had its password, GoTeam, in the site’s public source code, and the full dataset was downloadable from a public file index. The data appeared to cover every registered voter, including Gov. JB Pritzker, Mayor Brandon Johnson, judges and Cardenas himself. The login page was taken down by Sept. 3 and the data removed days later. Cardenas called it a programming glitch; the EFF called it a complete lapse in essential data security practices.
Mayoral Candidate’s Website Exposed Voting History Of 1.5 Million Chicago Residents →
Topics: Exposed databases and cloud misconfigurations
FTC orders nine companies to explain personalized pricing and gig pay
The Federal Trade Commission sent information orders to Delta Air Lines, United Airlines, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart, probing whether they use personal data to set different prices for the same products or to determine gig worker pay. The agency will examine loyalty programs and analysis of personal data by superintelligence algorithms, and whether compensation varies based on opaque formulas or drivers’ phone usage and acceptance history. Chairman Andrew Ferguson said consumers deserve to know if web surfing habits help estimate the highest price they can be charged. Companies have 45 days to respond; noncompliance could trigger legal action.
FTC probes whether major US companies charge customers different prices using personal data →
Character.AI bankruptcy raises prospect of sensitive chat data being sold
Character.AI’s bankruptcy could put users’ messages and secrets up for sale, even though its $20 million deal to sell some assets to Disney excludes user data. Tens of millions of people, including children, confided in the company’s chatbots. Calli Schroeder of the Electronic Privacy Information Center warned that people share far more with personified bots, and that even non-users are in the dataset because users discuss friends and family. Privacy policies typically list bankruptcy as an exception, and Character.AI’s permits using data to train models and build advertising profiles. Forty state attorneys general filed a notice seeking child safety and privacy protections. Character.AI has published data-deletion instructions.