GM Driver Data Settlement, Plus 3 Tech Stories
GM will pay $220 million over driver-data allegations
General Motors has agreed to pay $220 million to settle allegations that it collected drivers’ behavior and location data without meaningful consent, then sold that information to data brokers that supplied insurers. The Pennsylvania attorney general says the state will receive $8.67 million. Thirty-five states and the District of Columbia joined the settlement.
The data came from GM’s Smart Driver program between 2016 and 2024. It included when and how often someone drove, trip start and end times, hard braking, rapid acceleration, and speeding. That is enough to turn a feature marketed as driving feedback into an insurance risk profile. Regulators allege some dealership employees accepted enrollment terms for customers, and Michigan’s attorney general says the OnStar app incorrectly told more than 370,000 enrolled drivers that tracking was off.
GM settled the allegations without this agreement creating direct restitution for drivers. A private class action is still pending. Going forward, GM must obtain affirmative consent before collecting or disclosing driving and location data, limit collection, train dealerships, and submit to privacy-program assessments. An earlier FTC order also requires ways for U.S. consumers to request a copy or deletion of their data and to opt out of some collection.
This is the practical problem with connected car privacy: the car is also an account, a sensor package, and a source of information about your routine. We covered that wider ecosystem earlier this month in Your Car Is Talking to Big Tech. The settlement makes consent clearer, but a consent screen does not automatically make every use reasonable. It can still become the digital equivalent of “sign here so we can finish the sale.”
Current GM and OnStar users can visit the GM Privacy Center to review location and data controls or request a copy, correction, or deletion of personal information. There is a tradeoff: turning off vehicle location can disable navigation and other connected services, while emergency exceptions may remain. I would start by asking for the data and reviewing the settings before disabling useful safety features blindly. Know what the car sends, who receives it, and what you actually get in return.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Florida says financial-aid data for 4.9 million people may be exposed
The Florida Department of Education says unauthorized access to its student financial-aid website may have affected about 4.9 million people. Staff discovered the incident on October 19, and the department disclosed it publicly on October 29. The investigation is continuing, so that number and the exact scope may change.
The potentially exposed information includes Social Security numbers, names, birth dates, home addresses, phone numbers, email addresses, and gender identification codes. The department says not every person necessarily had every field exposed. It also says current aid payments, tuition disbursements, scholarships, grants, and loan eligibility are not affected. That is useful reassurance, but it answers the operational question, not the identity-theft question.
If you previously applied for financial aid in Florida, read the department’s breach notice and consider freezing your credit with all three major bureaus. A freeze blocks most new credit from being opened in your name; monitoring tells you after something appears. Keep watching financial accounts and official updates, too. Social Security numbers do not expire because the incident-response team closed a ticket.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
DreamHost says File Manager credentials were exposed
DreamHost has now explained the password resets that disrupted some customers last weekend. In an October 29 incident report, the hosting company says an attacker exploited a vulnerability in third-party software behind its browser-based File Manager. The attacker obtained FTP and SFTP usernames and passwords belonging to users who logged into File Manager between roughly August and October 23. The attacker also reached some webmail systems and captured a limited number of login credentials; DreamHost believes mailbox contents may have been viewed in a small number of cases.
DreamHost says the incident affected well under 10 percent of hosted email and FTP/SFTP accounts, and it has found no evidence that control-panel logins or billing details were accessed. That does not mean every site and mailbox in the affected group was altered. It also does not prove they were untouched.
Affected account owners should type panel.dreamhost.com into the browser, set new passwords, and update saved credentials in mail and file-transfer software. Then review site files, mailbox forwarding rules, and email filters for changes you did not make. Notify employees or clients through a phone call, secure text, or another channel outside the affected mailbox. A forced reset closes the old key. It cannot tell you whether someone used the key before the lock changed.
If the account stores customer information, the business may also need to document what was exposed and determine whether contracts or breach-notification rules apply. DreamHost specifically advises customers in that position to consult their legal counsel. That is not legal padding. Hosting incidents can create obligations for the site owner as well as the hosting company.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
The FTC wants to know whether your data changes your price
The FTC has ordered nine companies to explain how personal data may influence consumer prices or gig-worker pay. The list includes Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target, and Walmart. The companies have 45 days to provide information about pricing tools, loyalty-program data, browsing behavior, phone usage, and offer-acceptance history.
This is a study, not a finding that every named company secretly charges each person a different amount. Delta, for example, told the Associated Press that it does not use or plan a fare product that targets people with individualized offers based on personal data. The distinction matters. Dynamic pricing changes with demand, time, or inventory. Personalized pricing changes because the system thinks it knows what you will pay.
There is no urgent setting to change today, and clearing cookies is not a reliable answer to account-level data. What matters is what the FTC inquiry establishes. If personal data affects the price of a ticket or the pay offered for the same delivery, people deserve to know that before they click Accept. Transparency is not an advanced feature here. It is the minimum.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources and further reading
- Pennsylvania Office of Attorney General: GM driver-data settlement and Pennsylvania’s share.
- Michigan Department of Attorney General: enrollment allegations, app notification error, and restitution status.
- Federal Trade Commission: connected-vehicle consent, access, deletion, and opt-out requirements.
- General Motors Privacy Center: current consumer controls and location-service tradeoffs.
- Florida Department of Education: financial-aid breach scope, data fields, and recommended precautions.
- DreamHost: File Manager attack, affected credentials, and response guidance.
- DreamHost Knowledge Base: password-reset and account-review instructions.
- Federal Trade Commission: personalized pricing and compensation study.
- Associated Press: company response and broader context for the FTC inquiry.
- Photo by Vladimir Srajber on Pexels.
