Two enforcement actions landed on October 29 that rhyme: one about what happens to data collected in a car, the other about how hard a company made it to say no to a sale of data. Meanwhile the FTC turned its personalized-pricing scrutiny into formal orders, and New York joined California in writing rules for chatbots and minors. Here's what mattered.
Enforcement
A bipartisan coalition of 36 attorneys general secured $220 million from General Motors↗ over the sale of drivers' location and driving data. According to New York's release, from 2016 to 2024 GM enrolled millions of drivers in its Smart Driver program, which tracked trips, braking, acceleration, and speed, and told drivers it wouldn't share their data with insurers without express consent. The attorneys general found that GM instead sold the data to brokers under contracts specifying insurance use, and the brokers resold it to insurers who could adjust premiums. They also found that dealership employees were incentivized to enroll as many customers as possible, that employees sometimes accepted terms on customers' behalf, and that GM's OnStar app told more than 370,000 drivers they weren't enrolled when their data was in fact being collected and sold. GM will pay $220 million, including $12,054,341 to New York, and must limit the driving data it collects, set up in-house and third-party privacy assessment programs, and add oversight and training at dealerships. New York's list of participating states doesn't include California, which has its own separate GM settlement. The lesson for any company with connected products: consent captured by a salesperson at the point of sale is not consent, and a program's marketing promise is what regulators will hold you to.
California's Attorney General settled with Lyft for $1.8 million↗ over claims that the company violated the CCPA and the Unfair Competition Law by offering no way to opt out of the sale or sharing of personal information inside its app. According to the release, Lyft has sold or shared users' data to target in-app ads since mid-2023, and the only opt-out path ran from the in-app privacy policy to a web page where users who were already logged in had to re-enter their login and more personal information. Bonta's office called that an unnecessary barrier to exercising CCPA rights. Lyft must pay the penalty, add an in-app opt-out, and notify California consumers of their right to opt out. The case grew out of a March 2025 geolocation investigative sweep, and the office describes it as its ninth CCPA enforcement action. For app-only businesses, the practical takeaway is that opt-out has to work where the customer already is.
Guidance and Rulemaking
On October 28 the FTC launched a personalized pricing and compensation inquiry↗, issuing Section 6(b) orders to Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target, and Walmart. The orders seek documentation of the inputs, tools, and procedures used to set or adjust consumer prices and worker pay, including whether prices vary person to person based on factors such as loyalty-program participation or analysis of personal data. The FTC says drivers and delivery workers may also be paid based on their personal data, such as phone usage or history of accepting offers. Recipients have 45 days to respond, and the Commission can go to federal court to compel compliance. A 6(b) study isn't tied to a specific law enforcement action, but it follows the agency's August proposed enforcement policy statement on undisclosed personal-data pricing. IAPP's roundup↗ adds that Rep. Frank Pallone sent letters on October 22 to rideshare, ticketing, travel, and food-delivery companies, and that Connecticut, Maryland, New Jersey, and New York already have personalized pricing rules.
For a state-by-state view, Covington published a guide to the algorithmic pricing patchwork↗. New Jersey bars surveillance pricing for groceries, Maryland bars dynamic pricing of covered grocery items by food retailers and delivery providers, Connecticut limits algorithmic pricing to discounts and requires a disclosure when an exception applies, and New York requires disclosure of personalized algorithmic pricing, with passed amendments that would replace it with a ban. Seattle is the first city to restrict the practice. Covington's summary doesn't state effective dates, and it notes that commenters on the FTC's policy statement asked it to protect loyalty programs and tailored discounts, so check how broadly drafted rules treat coupons and loyalty offers.
Also on the calendar, Hunton reports that the CalPrivacy board will meet November 5 and 6↗ in San Francisco, with the second day including possible action on amendments about opt-out preference signals, including possible advancement to formal rulemaking, and preliminary rulemaking on reducing friction in exercising privacy rights and on notices and disclosures. The announcement doesn't describe the proposed text or comment periods.
New and Pending Legislation
New York Governor Kathy Hochul signed a youth AI chatbot safety bill↗ (S9051B/A10379C) on October 28, effective January 1, 2027. IAPP reports that it bans unsafe chatbot features for minors across 12 categories, including chatbots that present themselves as human, encourage self-harm, or engage in sexual or otherwise inappropriate conversations with children. Providers must verify age using multiple methods, at least one of which can't rely on government-issued ID, and delete age data once verification is complete. The attorney general will run a complaint portal, penalties reach $25,000 per violation, and injunctive relief includes deleting unlawfully obtained personal data.
In California, Hunton's analysis of AB 1979↗ says it treats businesses offering health care chatbots as health care providers under the state's medical confidentiality law, and bars health facilities and practices from using AI to direct or supervise unlicensed staff in licensed clinical functions or to perform them. AI used for documentation and routine communications is not prohibited. The law takes effect January 1, 2027; Hunton's post doesn't say when it was signed.
The Takeaway
The common thread is that regulators are scrutinizing data flows the customer never sees: driving data resold to insurers, an opt-out buried behind a login, and pricing or pay inputs hidden in an algorithm. The practical to-do list is concrete: trace where connected-product data goes after collection and who can enroll customers, test whether every opt-out works inside the app or flow where the customer actually is, document the personal-data inputs behind any dynamic pricing or worker pay and check them against the state patchwork, and put the January 1, 2027 chatbot and health-AI effective dates on the calendar.