Who clicked agree? Designing consent that survives an audit

Consent is not a paragraph in a privacy policy. It is a moment in a workflow, and whoever is holding the device owns that moment. On October 29, 2026, General Motors settled with 36 state attorneys general for $220 million over its Smart Driver program, and part of what sank it was consent completed by someone other than the person consenting. Healthcare has the same weak spot, and it is usually hiding in plain sight at the front desk.

What GM's dealers did

Smart Driver collected driving and location data that GM sold to third parties. Some of that data reached insurers who used it to set rates. The detail that matters for everyone outside the auto industry is how the consent was obtained: some customers were enrolled by dealership staff who accepted the terms on their behalf. The settlement now requires affirmative express consent, limits on data collection, outside privacy assessments, and dealer training. The Massachusetts attorney general's share alone was $5.7 million.

When a regulator treats staff-completed consent as a failure, the lesson is not really about cars. A signature collected by the wrong hand is not consent, however complete the paperwork looks.

Healthcare runs this risk every day

A health system has a dozen points where someone other than the patient can finish a consent step, often with the best of intentions and to save the patient time.

• Portal activation completed by front-desk staff while the patient waits.
• Intake tablets handed over with boxes already checked.
• Text-message enrollment a staffer taps through on the patient's behalf.
• Patient-support or copay program sign-ups filled in by a coordinator.

If anyone other than the person consenting can complete your consent flow, what you have is a form, not consent. That is the exact gap GM just paid for.

Design rules that hold up in an audit

Consent that survives scrutiny shares a few traits, and all of them are design decisions rather than legal ones.

• The person consenting completes the step on their own device, not on a staff workstation or a shared kiosk.
• Nothing is pre-checked. An opt-in that arrives already selected is not a choice the user made.
• The request is phrased plainly, in language a patient reads once and understands, with the data use and the recipients named.

Keep the proof

Design is half the job; the other half is evidence. Log who consented, when, on which device, and against which version of the terms. A consent record that cannot answer those four questions will not hold up when a regulator asks how the agreement was obtained, which is precisely the question the GM settlement turns on.

Train the staff, because training is a design input

Dealer training was one of the settlement terms, not an afterthought. The same applies in a clinic. The most carefully designed consent flow still fails if a busy staffer has learned to click through it to keep the line moving. The workflow and the training that surrounds it are one system, and they have to be built together.

We build patient and customer journeys where consent is a designed moment with an audit trail behind it, not a checkbox someone else can reach. The work pairs with the tracking and consent audit that confirms what a site actually fires, so the proof matches the promise.

Sources: WILX / Michigan AG, Michigan joins 36-state $220M GM settlement; Massachusetts AG, settlement with General Motors over data privacy violations.